# DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool

Burp Suite MCP server on 127.0.0.1:9876 lacks origin validation, so DNS rebinding lets a malicious page call send_http1_request for SSRF into internal networks.

- Payout: hidden
- Severity: none
- Program: PortSwigger Web Security
- Found by: farmer
- Disclosed: 2025-10-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3176157
- Library page: https://bugbountylibrary.com/r/h1%3A3176157
- Tags: area:web3 domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone tech:llm technique:recon vuln:cors vuln:ssrf

**Target:** Burp Suite MCP server HTTP endpoint on port 9876
**Root cause:** The MCP server binds to localhost but performs no Origin/Host validation or CORS restriction, so a rebinding domain that resolves to 127.0.0.1 is treated as same-origin and can drive its tools.
**Steps:**
1. Register a rebinding hostname (e.g. `7f000001.c0a80103.rbndr.us`) whose first DNS answer is attacker IP, later answers 127.0.0.1.
2. Host malicious `index.html` on attacker server; victim opens the rebinding URL.
3. JS connects to `http://<rebind-host>:9876` and fetches a session ID.
4. Call MCP `send_http1_request` tool to issue requests to internal hosts/cloud metadata.
5. Call `get_proxy_http_history` to read responses back.
**How found:** Noticed the MCP server on port 9876 lacked origin validation/CORS, hypothesized a browser could reach it cross-origin, and used DNS rebinding to defeat SOP.
**Exploitation:** Victim with Burp MCP enabled opens attacker link; after DNS rebind the page's origin resolves to 127.0.0.1, letting JS talk to the MCP server, obtain a session, invoke send_http1_request against internal targets, and exfiltrate responses via get_proxy_http_history.
**Escalation:** Chains SSRF with proxy history retrieval to read full HTTP responses, reaching internal services and cloud metadata endpoints.
**Insight:** Localhost-bound dev/agent servers (MCP, IDE, proxy APIs) that skip Origin/Host checks are rebindable; test them by pointing a rebinding domain at 127.0.0.1 and driving their tool endpoints from a browser.