GHSA-ppv2-x5g2-5q78: 
Python Análise e mitigação de vulnerabilidades

Summary

mulder serve --transport streamable-http (src/mulder/cli.py:131) calls mcp_server.run(transport="streamable-http"). The MCPServer("Mulder") instance (src/mulder/server/app.py:28) has no authentication configured, so any client that can reach the listener can call every forensic MCP tool. The SDK binds 127.0.0.1:8000 by default.

PoC

Tested against main @ 5ebc9ab.

1. Run mulder serve --transport streamable-http.
2. As any other local user, POST an MCP initialize to http://127.0.0.1:8000/mcp.
3. Send tools/call for open_case, submit_finding, delete_finding or finalize_report on any case in db_dir. The calls succeed with no credentials and are recorded in {case_id}.audit.jsonl as genuine provenance.

Impact

Any process that can reach the listener, by default a local process on the same host, can:

• read case data and evidence-derived tool output with the server user's rights;
• modify or fabricate findings, the narrative and reports, with those calls showing up in the audit trail as legitimate.

Fix

The fix branch on the temporary private fork makes three changes:

• It adds --host (default 127.0.0.1) and warns when binding a non-loopback address.
• When MULDER_HTTP_TOKEN is set, it serves the app through uvicorn behind an ASGI check. The check requires Authorization: Bearer <token>, compared with hmac.compare_digest, and returns 401 otherwise. The SDK's DNS-rebinding protection still applies.
• When the token is unset, it keeps the old path but prints and logs that the transport is unauthenticated. Maintainer choices:
• whether to make the token mandatory, at least for non-loopback hosts;
• whether to also enforce MULDER_ALLOWED_TOOLS on direct tool calls. AI disclosure: I used AI assistance to find or write up this report.