Summary
A server-side request forgery vulnerability in utcp-http allows a remote OpenAPI specification to control the OAuth2 token endpoint used by the library. When a victim registers an attacker-controlled specification and invokes the resulting protected tool, the victim's OAuth2 client credentials may be submitted to an attacker-selected endpoint.
Affected context
The vulnerability occurs in utcp-http deployments that consume remote or otherwise untrusted OpenAPI specifications and generate OAuth2-protected tools from them. It becomes risky when the library accepts an attacker-controlled tokenUrl value without validating its destination before submitting client credentials.
Exploit preconditions
- Attack surface: OpenAPI specification registration and generated OAuth2 tool invocation
- Required access: Ability to provide or cause a victim to register an attacker-controlled OpenAPI specification
- Trigger point: OAuth2 token acquisition for an invoked generated tool
- Why exploitation is possible: The remote specification can supply an arbitrary token endpoint, and the library submits OAuth2 client credentials without sufficient URL validation
Why this happens
The underlying bug is an insufficiently constrained outbound request destination derived from untrusted metadata.
OAuth2 tokenUrl values in remote OpenAPI specifications are treated as trusted configuration even though they can direct credential-bearing requests to attacker-controlled infrastructure.
This maps to CWE-918: Server-Side Request Forgery, because attacker-influenced input controls a server-side HTTP request and its destination. The request also creates a credential-exfiltration risk because sensitive OAuth2 fields are included in the outbound submission.
Potential impact
- OAuth2 client identifiers and client secrets may be disclosed
- Attackers could receive or misuse credentials submitted to their endpoint
- The application may make unintended outbound requests
- Internal services or restricted network locations could be probed, depending on network access
- Downstream APIs and data may be accessed using compromised credentials
General mitigation guidance
Mitigation generally focuses on treating OpenAPI security metadata as untrusted input and separating specification data from credential-handling policy.
Common defensive patterns include:
- Allowing token requests only to explicitly approved HTTPS origins
- Rejecting loopback, link-local, private, link-local, and otherwise restricted network destinations unless specifically required
- Validating and normalizing URLs before any credential-bearing request is created
- Avoiding transmission of client secrets to destinations that are not governed by an explicit trust policy
- Applying outbound network controls and egress allowlists
- Using least-privilege OAuth2 credentials with narrowly scoped permissions
- Requiring user or administrator approval before registering untrusted specifications
These controls reduce both SSRF exposure and the consequences of credential disclosure.
How teams detect issues like this
Detection approaches can include:
- Static analysis for HTTP request destinations derived directly from OpenAPI fields or other remote metadata
- Code review checks for missing URL scheme, hostname, port, and network-range validation
- Tests using attacker-controlled token endpoints, redirects, private addresses, and alternate URL representations
- Runtime monitoring for OAuth2 token requests to unapproved domains or unusual network ranges
- Egress policy enforcement that blocks unauthorized outbound destinations
- Automated security review tools that identify SSRF data flows and credential-bearing requests
