This page is served from . The browser will POST to /mcp on this same origin. In a real DNS-rebind attack, the second-and-later requests would re-resolve to the victim's IP — the browser thinks it's still talking to evil.example:3000, but at the network layer it's actually hitting the locally-running MCP server.
Since Chrome's internal DNS cache has a 60-second minimum TTL (regardless of what the DNS server claims), reliably reproducing DNS rebinding in a headless test requires Singularity-style infrastructure. This PoC uses the simpler equivalent: the attacker nginx proxies /mcp to the victim, forwarding the browser-set Origin: http://evil.example:3000 and Host: evil.example:3000 headers unchanged. The vulnerability under test — mcp-streamablehttp-proxy v0.2.0 accepting requests with mismatched Origin/Host — is identical in both attack paths.
Loading…
… in progress …