Ensure Origin header is validated on all Streamable HTTP requests to prevent DNS rebinding attacks

높음레벨 1자동mcp-server

설명

Streamable HTTP servers validate the Origin header on every incoming request. When the Origin header is present and is not on the operator-configured allowlist, the server returns HTTP 403. This is enforced on the request itself, not only on a CORS preflight. Because non-browser MCP clients routinely send no Origin, the specification does not require an absent Origin to be rejected, and a server may accept it or, under a stricter local policy, reject it. The control targets a present, hostile Origin, which is the DNS- rebinding shape. For locally bound servers, bind to localhost and reject non-localhost Origins. DNS rebinding lets a remote web page re-resolve its own domain to a loopback address and then issue requests to a locally bound MCP server, which is why developer-facing localhost deployments are the prime target. Without Origin validation the server cannot distinguish a legit...

점검 방법

감사 방식: 셸 명령

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_2_5"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 2.5"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure the MCP server to validate the Origin header on every Streamable HTTP request and return HTTP 403 for any present Origin not on an explicit allowlist, logging the rejection as a security event. For locally bound servers, bind to localhost and reject non-localhost Origins. As layered defense, the gateway can enforce the allowlist. The following nginx example is illustrative: map $http_origin $cis_mcp_origin_ok { default 0; "https://app.example.com" 1; } server { location /mcp { if ($cis_mcp_origin_ok) { set $cis_block 0; } if ($http_origin) { set $cis_block "${cis_block}1"; } if ($cis_block = 1) { return 403; } proxy_pass http://mcp_upstream; } } The gateway enforces the allowlist for present Origins but does not replace server-side validation, which the specification requires. Where a web UI is served alongside the MCP endpoint, set an explicit Access-Control-Allow-Origin allowlist, do not combine Access-Control-Allow-Credentials: true with a wildcard origin, and set a restrictive Content-Security-Policy: frame-ancestors.

속성

운영 체제: 모두
태그: aimcpmcp-server
참고 자료: CIS MCP Server Benchmark v1.0.0 - 2.5 Ensure Origin header is validated on all Streamable HTTP requests to prevent DNS rebinding attacks

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mcp-server