Ufo
Monthly
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. No public exploit code has been identified at time of analysis, though the DNS rebinding technique is well-documented and the commit-confirmed patch validates the described attack path.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an ADB-connected Android device before version 3.0.8. The create_mobile_data_collection_server and create_mobile_action_server components bind Streamable HTTP MCP services to TCP 8020 and 8021 with no credential check, exposing tools such as capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control to anyone who can reach the ports. No public exploit identified at time of analysis, but the fix (adding UFO_MCP_API_KEY bearer auth) is confirmed in the vendor advisory GHSA-24fq-m9rr-g3mm and release v3.0.8, and the high EPSS-relevant impact (CVSS 9.4) makes this a serious exposure wherever the mobile agent is run on a reachable interface.
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass the SSRF guard by supplying IPv6 transition addresses - NAT64 (64:ff9b::/96, 64:ff9b:1::/48), 6to4 (2002::/16), or Teredo (2001::/32) - that embed private or link-local IPv4 destinations the guard would otherwise reject. The bypass grants access to cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or localhost in any deployment where UFO processes externally-influenced URLs. No active exploitation is confirmed (not in CISA KEV), but the technique is well-documented in SSRF research and the fix is available in version 3.0.8.
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanently deny legitimate task owners access to their sessions or flood the shared session store with phantom entries. The COMMAND_RESULTS handler in ufo/server/ws/handler.py invoked get_or_create_session with a caller-supplied session_id but omitted the owner_client_id binding, and the message type carried no role gate - meaning any authenticated peer could pre-register arbitrary session IDs before their intended owners. This issue is not in CISA KEV and no public exploit has been identified, though the fix commit's regression tests provide a near-complete exploitation blueprint.
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to retrieve another enrolled device's server-side system_info - including hostname, IP address, and metadata tags - by supplying an arbitrary target_id in a DEVICE_INFO_REQUEST message. Affected versions 3.0.0 through 3.0.5 authenticate the caller's role but omit object-level authorization in handle_device_info_request and get_device_info (ufo/server/ws/handler.py), meaning DEVICE clients can enumerate peers that only CONSTELLATION controllers should be able to query. No public exploit identified at time of analysis; vendor-released patch is version 3.0.6.
DNS rebinding against Microsoft UFO's Linux MCP server (all versions prior to 3.0.8) enables an attacker-controlled web page to bypass localhost binding protections and reach the local /mcp endpoint via the victim's browser. Because the FastMCP streamable HTTP server bound to localhost:8010 performed no Host, Origin, or Sec-Fetch-Site header validation, a browser performing a DNS rebind could enumerate available tool schemas via tools/list and invoke execute_command with a valid UFO_MCP_API_KEY, resulting in arbitrary file reads or OS command execution as the victim's local user. No public exploit code has been identified at time of analysis, though the DNS rebinding technique is well-documented and the commit-confirmed patch validates the described attack path.
Missing authentication in Microsoft UFO's mobile MCP servers lets an unauthenticated remote attacker fully control an ADB-connected Android device before version 3.0.8. The create_mobile_data_collection_server and create_mobile_action_server components bind Streamable HTTP MCP services to TCP 8020 and 8021 with no credential check, exposing tools such as capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control to anyone who can reach the ports. No public exploit identified at time of analysis, but the fix (adding UFO_MCP_API_KEY bearer auth) is confirmed in the vendor advisory GHSA-24fq-m9rr-g3mm and release v3.0.8, and the high EPSS-relevant impact (CVSS 9.4) makes this a serious exposure wherever the mobile agent is run on a reachable interface.
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass the SSRF guard by supplying IPv6 transition addresses - NAT64 (64:ff9b::/96, 64:ff9b:1::/48), 6to4 (2002::/16), or Teredo (2001::/32) - that embed private or link-local IPv4 destinations the guard would otherwise reject. The bypass grants access to cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or localhost in any deployment where UFO processes externally-influenced URLs. No active exploitation is confirmed (not in CISA KEV), but the technique is well-documented in SSRF research and the fix is available in version 3.0.8.
Session-squatting and memory exhaustion in Microsoft UFO's WebSocket server allow any authenticated client to permanently deny legitimate task owners access to their sessions or flood the shared session store with phantom entries. The COMMAND_RESULTS handler in ufo/server/ws/handler.py invoked get_or_create_session with a caller-supplied session_id but omitted the owner_client_id binding, and the message type carried no role gate - meaning any authenticated peer could pre-register arbitrary session IDs before their intended owners. This issue is not in CISA KEV and no public exploit has been identified, though the fix commit's regression tests provide a near-complete exploitation blueprint.
Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to retrieve another enrolled device's server-side system_info - including hostname, IP address, and metadata tags - by supplying an arbitrary target_id in a DEVICE_INFO_REQUEST message. Affected versions 3.0.0 through 3.0.5 authenticate the caller's role but omit object-level authorization in handle_device_info_request and get_device_info (ufo/server/ws/handler.py), meaning DEVICE clients can enumerate peers that only CONSTELLATION controllers should be able to query. No public exploit identified at time of analysis; vendor-released patch is version 3.0.6.