Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Weakness
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Extended Description
When a server binds to the address 0.0.0.0, it allows connections from every IP address on the local machine, effectively exposing the server to every possible network. This might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.
Potential Mitigations
Related Attack Patterns
References
- https://github.com/penpot/penpot
- https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52
- https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb
- https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
- https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r
- https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge
- https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r