Summary
Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim
Details
https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L260-L278
Victim starts a legitimate MCP session and receives session ID abc-123
Attacker obtains the session ID (various means - network sniffing, logs, etc. out of scope for this analysis)
Attacker sends POST to /messages/abc-123 with a tool call
Server accepts the request (no ownership validation!)
Server executes the tool and sends response to victim's SSE stream
Victim receives attacker's response, thinking it's legitimate
PoC
attacker_client.py
legitimate_client.py
Prerequisites
- Python 3.8+
- Install dependencies:
requests
Running the Demo
- Terminal 1: Start the Ruby MCP Server
ruby streamable_http_server.rb
Makes use of https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb
This server has a tool call notification_tool which the clients call
- Terminal 2: Start Victim Client
python3 legitimate_client.py
- Terminal 3 - Attacker Client:
Copy the session ID from Terminal 1 and run:
python3 attacker_client.py abc-123-def-456
- Back to Terminal 2 - Victim sees the injected response:
Impact
- Integrity: HIGH - Attacker can execute unauthorized tools and modify state
- Availability: LOW - Attacker can disrupt victim's session with injected responses
Additional Details
Session Hijacking Protection in MCP Implementations
The MCP specification recommends - "MCP servers SHOULD bind session IDs to user-specific information".
User Binding - Comparison other SDKs
csharp-sdk
Go-sdk
Comparison with the Stream Replacement vulnerability
Stream Replacement
GHSA-qvqr-5cv7-wh35
- Target: SSE stream connection
- Attack Vector: GET /mcp
- What happens to Victim: The connection is disconnected and doesn't receive reponses
Session Poisoning
- Target: Tool execution
- Attack Vector: POST /mcp
- What happens to Victim: The connection stays connected and receives responses of tool calls by attacker
Summary
Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim
Details
https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L260-L278
Victim starts a legitimate MCP session and receives session ID abc-123
Attacker obtains the session ID (various means - network sniffing, logs, etc. out of scope for this analysis)
Attacker sends POST to /messages/abc-123 with a tool call
Server accepts the request (no ownership validation!)
Server executes the tool and sends response to victim's SSE stream
Victim receives attacker's response, thinking it's legitimate
PoC
attacker_client.py
legitimate_client.py
Prerequisites
requestsRunning the Demo
ruby streamable_http_server.rbMakes use of https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb
This server has a tool call notification_tool which the clients call
python3 legitimate_client.pyCopy the session ID from Terminal 1 and run:
Impact
Additional Details
Session Hijacking Protection in MCP Implementations
The MCP specification recommends - "MCP servers SHOULD bind session IDs to user-specific information".
User Binding - Comparison other SDKs
csharp-sdk
Go-sdk
Comparison with the Stream Replacement vulnerability
Stream Replacement
GHSA-qvqr-5cv7-wh35
Session Poisoning