Vulnerable code sample

import urllib.parse

# This code represents a simplified version of the vulnerable components
# in FastMCP prior to version 3.2.0, as described in CVE-2026-32871.
# The CVE number is fictional, but the vulnerability pattern is real.

class RequestDirector:
    """
    A simplified representation of the RequestDirector class responsible for
    constructing backend requests.
    """
    def __init__(self, backend_base_url):
        # The base URL of the internal backend service.
        self.backend_base_url = backend_base_url
        # In a real scenario, this would hold authentication tokens for the backend.
        self.auth_headers = {"Authorization": "Bearer server-secret-token"}

    def _build_url(self, path_template, path_params):
        """
        VULNERABLE METHOD: Constructs the final URL to the backend service.
        This method is vulnerable because it does not URL-encode the parameter
        values before substituting them into the path template.
        """
        # VULNERABILITY: Direct string substitution without any sanitization or
        # URL-encoding of the parameters provided by the MCP client.
        substituted_path = path_template.format(**path_params)

        # The `urllib.parse.urljoin` function will then resolve '..' sequences,
        # allowing an attacker to traverse up the URL path from the intended API prefix.
        final_url = urllib.parse.urljoin(self.backend_base_url, substituted_path)
        
        return final_url

    def direct_request(self, path_template, path_params):
        """
        Simulates directing a request from an MCP client to the backend.
        """
        # Build the URL using the vulnerable method.
        target_url = self._build_url(path_template, path_params)
        
        print(f"[*] Simulating authenticated request to backend service...")
        print(f"[*]   Target URL: {target_url}")
        print(f"[*]   Headers: {self.auth_headers}")
        print(f"[*] --- This request would be sent to the backend ---")
        
        return target_url

# --- Demonstration of the Vulnerability ---

if __name__ == '__main__':
    # Configuration of the MCP Provider
    # The internal service that the MCP server communicates with.
    BACKEND_SERVICE_URL = "http://internal-backend-service:8080/"
    
    # The OpenAPI operation path template.
    API_PATH_TEMPLATE = "/api/v1/users/{user_id}"

    # Instantiate the director
    director = RequestDirector(BACKEND_SERVICE_URL)

    # --- 1. Legitimate Use Case ---
    print("--- Legitimate Use Case ---")
    legitimate_params = {'user_id': 'user-abc-123'}
    director.direct_request(API_PATH_TEMPLATE, legitimate_params)
    # Expected safe URL: http://internal-backend-service:8080/api/v1/users/user-abc-123
    
    print("\n" + "="*40 + "\n")

    # --- 2. Attack Scenario (Path Traversal) ---
    print("--- Attack Scenario (Path Traversal) ---")
    # The attacker controls the 'user_id' parameter.
    # The payload uses '..' to traverse up from '/api/v1/users/'
    # and access an unintended internal endpoint.
    # The path is /api/v1/users/{payload}. We need to go up 3 levels to escape.
    attack_payload = "../../../internal/monitoring/health"
    attack_params = {'user_id': attack_payload}
    
    director.direct_request(API_PATH_TEMPLATE, attack_params)
    # The vulnerability causes the final URL to be:
    # http://internal-backend-service:8080/internal/monitoring/health
    # This allows the attacker to bypass the intended '/api/v1/' scope
    # and access arbitrary endpoints on the backend service with the
    # server's authentication credentials (Authenticated SSRF).