CVE-2025-65512
📋 TL;DR
A Server-Side Request Forgery (SSRF) vulnerability in markdownify-mcp allows attackers to bypass private IP restrictions using hostname-based bypass techniques and HTTP redirect chains. This enables unauthorized access to internal network services that should be protected. Users of markdownify-mcp version 0.0.2 and earlier are affected.
💻 Affected Systems
- markdownify-mcp
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal services, exfiltrate data, or pivot to other internal systems, potentially leading to full network compromise.
Likely Case
Unauthorized access to internal HTTP services, information disclosure from internal APIs, or scanning of internal network resources.
If Mitigated
Limited to accessing only publicly accessible services or blocked by additional network segmentation controls.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and this specific bypass technique is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Network-level SSRF protection
allImplement network egress filtering to restrict outbound connections from the application server
Application-level URL validation
allImplement strict URL validation that resolves hostnames and validates IP addresses before making requests
🧯 If You Can't Patch
- Disable the webpage-to-markdown conversion feature entirely
- Implement a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if markdownify-mcp version is 0.0.2 or earlier and if webpage-to-markdown feature is enabledCheck Version:
Check package.json or application configuration for markdownify-mcp versionVerify Fix Applied:
Test SSRF bypass techniques using hostname-based bypass and redirect chains against the application📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the application server
- Requests to internal IP addresses or hostnames
Network Indicators:
- HTTP traffic from application server to internal services
- Unusual redirect patterns in HTTP traffic
SIEM Query:
source="markdownify-mcp" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16)