Summary
A Server-Side Request Forgery vulnerability in the cloud-healthcare-fhir-fetch-page tool allows an attacker to control the URL requested by an authenticated client. Because the client automatically sends its bearer token to the selected destination, an attacker may capture credentials and potentially access protected healthcare data or connected Google Cloud services.
Affected context
The issue occurs in deployments of googleapis/mcp-toolbox that expose the cloud-healthcare-fhir-fetch-page tool and use an authenticated HTTP transport. Risk increases when the pageURL parameter can be influenced by an untrusted client or by pagination-related data, because the transport may attach authorization headers without verifying that the destination belongs to an approved service.
Exploit preconditions
- Attack surface: The cloud-healthcare-fhir-fetch-page tool and its HTTP request handling
- Required access: Ability to invoke the tool or influence data used by its pagination flow
- Trigger point: An outbound request generated from the attacker-controlled pageURL value
- Why exploitation is possible: The URL is not sufficiently restricted, while the authenticated transport automatically applies a bearer token regardless of the destination host
Why this happens
The vulnerability results from combining attacker-controlled outbound request destinations with unconditional credential forwarding. This is a Server-Side Request Forgery issue under CWE-918, because the server performs requests to a URL selected by an untrusted party. The automatic attachment of OAuth or service-account authorization headers turns the SSRF into a credential-exfiltration path rather than limiting the request to ordinary network access.
Potential impact
- An attacker may capture an end-user OAuth token
- An attacker could obtain a broader service-account or application-default credential
- Exposed credentials may enable unauthorized access to protected healthcare information
- Compromised tokens could permit access to secondary Google Cloud Platform services
- The affected environment may suffer data disclosure, account misuse, or lateral movement
General mitigation guidance
Mitigation generally focuses on restricting outbound destinations and separating credentialed requests from requests to untrusted URLs.
Common defensive patterns include:
- Allowlisting approved schemes, hosts, ports, and URL paths
- Rejecting private, loopback, link-local, metadata-service, and otherwise unexpected destinations
- Validating and normalizing URLs before making network requests
- Avoiding automatic authorization-header forwarding across host boundaries
- Using destination-specific clients with narrowly scoped credentials
- Applying least-privilege permissions and short-lived tokens
- Treating pagination links and response-derived URLs as untrusted input
- Enforcing egress controls at the network and workload-policy layers
How teams detect issues like this
Detection approaches can include:
- Static analysis for HTTP requests that consume user-controlled URLs
- Code review checks for unconditional authorization-header forwarding
- Tests covering cross-host redirects, pagination links, metadata endpoints, and private address ranges
- Runtime monitoring for outbound requests to unapproved domains or unusual network ranges
- Policy enforcement that requires URL allowlists and blocks credential forwarding to external hosts
- Automated security review tools that identify SSRF and sensitive-header propagation patterns
