Summary
MoLing's SSE mode exposes unauthenticated /sse and /message endpoints while permitting requests from any origin. A malicious webpage may obtain an active session identifier through a cross-origin browser request and use it to invoke MCP tools, potentially affecting local files, commands, or other configured capabilities.
MoLing's SSE mode exposes unauthenticated /sse and /message endpoints while permitting requests from any origin. A malicious webpage may obtain an active session identifier through a cross-origin browser request and use it to invoke MCP tools, potentially affecting local files, commands, or other configured capabilities.
Affected context
The issue occurs when MoLing is run in SSE mode using the -l option and its HTTP endpoints are reachable by a victim's browser. The vulnerable context combines missing request authentication with a permissive Access-Control-Allow-Origin: * policy, allowing browser-based cross-origin access even when the service is bound only to a loopback interface.
The issue occurs when MoLing is run in SSE mode using the -l option and its HTTP endpoints are reachable by a victim's browser. The vulnerable context combines missing request authentication with a permissive Access-Control-Allow-Origin: * policy, allowing browser-based cross-origin access even when the service is bound only to a loopback interface.
Exploit preconditions
- Attack surface: The
/sseand/messageHTTP endpoints exposed by MoLing's SSE mode - Required access: A victim must be running the SSE service and visit or load an attacker-controlled webpage
- Trigger point: The webpage opens a cross-origin
EventSourceconnection to/sse, receives the session endpoint, and submits requests to/message - Why exploitation is possible: Requests are unauthenticated, and the permissive CORS policy allows browser scripts to read the session identifier and reuse it for MCP tool calls
- Attack surface: The
/sseand/messageHTTP endpoints exposed by MoLing's SSE mode - Required access: A victim must be running the SSE service and visit or load an attacker-controlled webpage
- Trigger point: The webpage opens a cross-origin
EventSourceconnection to/sse, receives the session endpoint, and submits requests to/message - Why exploitation is possible: Requests are unauthenticated, and the permissive CORS policy allows browser scripts to read the session identifier and reuse it for MCP tool calls
Why this happens
The underlying flaw is missing authentication on security-sensitive HTTP endpoints, mapping to CWE-306: Missing Authentication for Critical Function. The service treats possession of a disclosed session identifier as sufficient authority to invoke MCP tools. The wildcard CORS policy, associated with CWE-942: Permissive Cross-domain Policy with Untrusted Domains, further allows arbitrary websites to interact with and read responses from the local service.
The underlying flaw is missing authentication on security-sensitive HTTP endpoints, mapping to CWE-306: Missing Authentication for Critical Function. The service treats possession of a disclosed session identifier as sufficient authority to invoke MCP tools. The wildcard CORS policy, associated with CWE-942: Permissive Cross-domain Policy with Untrusted Domains, further allows arbitrary websites to interact with and read responses from the local service.
Potential impact
- An attacker may invoke MCP tools without authorization
- Local files could be read, modified, or deleted depending on enabled tools
- Commands could be executed with the privileges of the MoLing process
- Sensitive information could be exposed through tool responses
- The victim's local environment could be altered or used for further activity
- An attacker may invoke MCP tools without authorization
- Local files could be read, modified, or deleted depending on enabled tools
- Commands could be executed with the privileges of the MoLing process
- Sensitive information could be exposed through tool responses
- The victim's local environment could be altered or used for further activity
General mitigation guidance
Mitigation generally focuses on authenticating every security-sensitive endpoint and reducing browser trust across local service boundaries.
Common defensive patterns include:
- Require authentication and authorization for both session establishment and message submission
- Treat session identifiers as non-secret routing values rather than sufficient authorization
- Replace wildcard CORS with an explicit, minimal origin allowlist, or disable browser cross-origin access when it is not required
- Apply CSRF-resistant request validation where browser interaction is possible
- Restrict exposed MCP tools and run the service with least privilege
- Prefer secure-by-default network exposure settings and isolate the service from untrusted browser contexts
Mitigation generally focuses on authenticating every security-sensitive endpoint and reducing browser trust across local service boundaries.
Common defensive patterns include:
- Require authentication and authorization for both session establishment and message submission
- Treat session identifiers as non-secret routing values rather than sufficient authorization
- Replace wildcard CORS with an explicit, minimal origin allowlist, or disable browser cross-origin access when it is not required
- Apply CSRF-resistant request validation where browser interaction is possible
- Restrict exposed MCP tools and run the service with least privilege
- Prefer secure-by-default network exposure settings and isolate the service from untrusted browser contexts
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for HTTP handlers that lack authentication middleware
- Review of CORS configuration for wildcard origins on local or administrative services
- Tests that attempt cross-origin access to session endpoints and verify that authorization is enforced
- Runtime monitoring of unexpected
/sseconnections and/messagetool-invocation activity - Policy enforcement requiring authentication, explicit origin controls, and least-privilege tool configuration for MCP servers
Automated security review tools may help identify unauthenticated routes and overly broad CORS settings.
Organizations can look for this class of issue through:
- Static analysis and code review checks for HTTP handlers that lack authentication middleware
- Review of CORS configuration for wildcard origins on local or administrative services
- Tests that attempt cross-origin access to session endpoints and verify that authorization is enforced
- Runtime monitoring of unexpected
/sseconnections and/messagetool-invocation activity - Policy enforcement requiring authentication, explicit origin controls, and least-privilege tool configuration for MCP servers
Automated security review tools may help identify unauthenticated routes and overly broad CORS settings.
