How an Unauthenticated MCP Server Led to SSRF, LFI, and AWS Credential Theft

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The unauthenticated MCP server was reachable externally and could be interacted with directly through exposed protocol methods (‘the endpoint was active, responding to standard MCP protocol requests, and required no authentication whatsoever’).
• [T1589] Gather Victim Identity Information – The server exposed internal tool listings and prompts that revealed capabilities and workflow structure (‘any external actor…could enumerate every available tool, resource definition, and prompt registered with the server’).
• [T1213] Data from Information Repositories – Internal resources and prompts were exposed through unauthenticated tool enumeration, allowing discovery of sensitive operational details (‘a full listing of internal tools, resources, and prompts built into the AI workflow’).
• [T1190] Server-Side Request Forgery – The audio download utility accepted an arbitrary URL and made outbound requests on the attacker’s behalf (‘Following that link caused the server to make an outbound request to the IMDS endpoint on the attacker’s behalf’).
• [T1552.001] Credentials In Files – Local file inclusion retrieved /proc/self/environ, exposing plaintext database credentials stored as environment variables (‘contained plaintext database credentials stored as environment variables’).
• [T1087] Account Discovery – The exposed telephony and messaging tools allowed discovery of internal platform functions and potentially related user/account metadata (‘voice call management, SMS dispatch, audio content processing, number metadata retrieval’).
• [T1041] Exfiltration Over C2 Channel – The proxy endpoint returned sensitive data such as IAM credentials and environment contents back to the requester (‘returned a JSON payload’ and ‘plaintext database credentials…leaked via /proc/self/environ’).