CVE-2026-54504: 
JavaScript 취약성 분석 및 완화

CVE-2026-54504 is a missing authentication and unsafe network binding vulnerability in the npm package @andrea9293/mcp-documentation-server v1.13.0. The Web UI/API, which starts automatically by default on port 3080, binds to all network interfaces (0.0.0.0:3080) instead of localhost only, and exposes document-management API endpoints without any authentication requirement. This allows any network-reachable client on the same LAN, VM network, or container bridge to perform full document-admin operations without credentials. The vulnerability was reported by researcher mcfly-zzh, published on June 4, 2026, and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a combination of CWE-306 (Missing Authentication for Critical Function) and CWE-668 (Exposure of Resource to Wrong Sphere). In src/web-server.ts, the Express application calls app.listen(PORT) without specifying a bind address, which causes Node.js/Express to default to listening on all interfaces (0.0.0.0). The Web UI starts automatically unless the environment variable START_WEB_UI is explicitly set to false. The exposed API endpoints — including GET /api/documents, GET /api/documents/:id, POST /api/documents, POST /api/search-all, DELETE /api/documents/:id, and GET /api/config — perform no authorization checks, accepting any unauthenticated HTTP request. A public proof-of-concept Python script was included in the advisory, demonstrating full document enumeration, insertion, reading, searching, and deletion via the host's LAN IP without any Authorization header (GitHub Advisory, Security Advisory).

A network-adjacent unauthenticated attacker can read all document titles, previews, and full content stored in the MCP documentation server; search across the entire document corpus; insert attacker-controlled documents into the knowledge base; and delete existing documents. This poses a high confidentiality risk if sensitive information is stored in the documentation server, a high integrity risk due to the ability to tamper with the AI assistant's knowledge base (potentially enabling prompt injection or misinformation attacks), and a high availability risk through mass document deletion. Users running the server on laptops, workstations, development VMs, or hosts connected to shared networks, VPNs, or Docker bridges are all potentially affected (GitHub Advisory).

1. Reconnaissance: Identify hosts on the local network running @andrea9293/mcp-documentation-server v1.13.0 by scanning for open TCP port 3080 using tools like nmap -p 3080 <subnet> or masscan.
2. Confirm exposure: Send an unauthenticated HTTP GET request to /api/config on the target host's LAN IP (e.g., curl http://10.0.250.230:3080/api/config) and verify a JSON response is returned without any authentication challenge.
3. Enumerate documents: Issue GET http://<target-ip>:3080/api/documents to list all stored document IDs and titles without credentials.
4. Read document contents: For each document ID returned, send GET http://<target-ip>:3080/api/documents/<id> to retrieve the full document content, potentially exposing sensitive information stored in the MCP knowledge base.
5. Search the corpus: Use POST http://<target-ip>:3080/api/search-all with a JSON body {"query": "<keyword>", "limit": 10} to search across all documents for targeted information.
6. Insert malicious documents: Send POST http://<target-ip>:3080/api/documents with a JSON body containing attacker-controlled content to poison the AI assistant's knowledge base, potentially enabling downstream prompt injection attacks.
7. Delete documents: Issue DELETE http://<target-ip>:3080/api/documents/<id> to destroy documents, causing availability impact to the MCP assistant's knowledge base (GitHub Advisory, Security Advisory).

• Network: Unexpected inbound HTTP connections to TCP port 3080 from non-localhost IP addresses; ss -ltnp output showing LISTEN *:3080 instead of 127.0.0.1:3080; HTTP requests to /api/documents, /api/config, /api/search-all originating from LAN or external IPs.
• Logs: Node.js/Express access logs showing requests to document-management API endpoints (/api/documents, /api/documents/:id, /api/search-all, /api/config) from non-loopback IP addresses without Authorization headers; server startup log line Network: http://0.0.0.0:3080 indicating all-interface binding.
• File System: Unexpected or unfamiliar documents appearing in the MCP documentation server's data directory (MCP_BASE_DIR); documents with suspicious titles or content (e.g., containing attacker markers or injected instructions) in the document store.
• Process: Node.js process (node dist/server.js) listening on 0.0.0.0:3080 as confirmed by ss -ltnp | grep 3080 or netstat -tlnp | grep 3080 (GitHub Advisory).

The vendor released version 1.13.1 on June 4, 2026, which binds the Web UI to 127.0.0.1 by default and introduces a new WEB_HOST environment variable (defaulting to 127.0.0.1) for explicit network exposure control. Users should upgrade to @andrea9293/mcp-documentation-server v1.13.1 or later immediately via npm update @andrea9293/mcp-documentation-server. As an interim workaround on v1.13.0, set START_WEB_UI=false to disable the Web UI entirely, or use host-based firewall rules to block external access to TCP port 3080. If network exposure is required in v1.13.1+, set WEB_HOST=0.0.0.0 explicitly and implement network-level access controls (GitHub Release, Patch Commit).