Markdownify MCP Server 允许通过 Markdownify.get() 函数进行服务器端请求伪造 (SSRF)

The SSRF vulnerability in mcp-markdownify-server allows an attacker to leverage the Markdownify.get() function to craft malicious prompts. These prompts, when processed by the MCP host, can trigger the server to make HTTP requests to attacker-controlled URLs. This can lead to the leakage of sensitive information, such as internal network details, API keys, or credentials stored within the server's environment. The attacker could potentially read responses from internal services that are not directly accessible from the outside, effectively bypassing security controls. The blast radius extends to any internal resources accessible via HTTP/HTTPS from the server running mcp-markdownify-server.

Applications and services utilizing the mcp-markdownify-server package, particularly those deployed in environments with sensitive internal resources accessible via HTTP/HTTPS, are at risk. This includes development environments, testing servers, and production deployments where the package is used for markdown processing.

• nodejs: Monitor process execution for suspicious outbound HTTP requests originating from the mcp-markdownify-server process. Use ps aux | grep mcp-markdownify-server to identify running processes and netstat -an | grep mcp-markdownify-server to check connections.

ps aux | grep mcp-markdownify-server
netstat -an | grep mcp-markdownify-server

• generic web: Check access logs for requests to unusual or unexpected URLs originating from the server hosting mcp-markdownify-server. Look for patterns indicative of SSRF attempts.

grep 'markdownify-server' /var/log/apache2/access.log

1. 2025-05-29Disclosure

   disclosure

1. 已保留2025-05-27
2. 发布日期2025-05-29
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-5276 is to upgrade to a version of mcp-markdownify-server that addresses the vulnerability. Since a specific fixed version is not provided, upgrading to the latest available version (*) is recommended. If upgrading is not immediately feasible, consider implementing input validation on the Markdownify.get() function to restrict the URLs that can be accessed. Additionally, employing a Web Application Firewall (WAF) with SSRF protection rules can help block malicious requests. Regularly review and update the server's firewall rules to restrict outbound connections to only necessary destinations.