[Security] DNS Rebinding (TOCTOU) bypass in SSRF protection + MCP tools bypass SSRF validation entirely

[Correctover]

Security Vulnerability Report

I have identified two security vulnerabilities in crewai/crewai-tools related to SSRF protection:

Vulnerability 1: DNS Rebinding (TOCTOU) in safe_get() / validate_url()

Location: crewai_tools/security/safe_requests.py + safe_path.py

Issue: validate_url() resolves DNS and checks the IP against private/reserved ranges, then returns the URL as a string. The subsequent requests.get(url) call resolves DNS again, creating a TOCTOU window where the DNS record can change between validation and connection.

Impact: DNS rebinding attack can bypass SSRF protection to access cloud metadata (169.254.169.254) and internal services.

Fix: Use a custom HTTP transport that pins the resolved IP for the actual connection, eliminating the second DNS resolution.

Vulnerability 2: MCP Tool Wrappers bypass SSRF protection entirely

Location: crewai/tools/mcp_tool_wrapper.py + crewai/tools/mcp_native_tool.py

Issue: When CrewAI agents call MCP tools, arguments (including URLs) are passed directly to MCP servers without going through validate_url() or safe_get(). This completely bypasses the SSRF protection for any agent using MCP tools.

Impact: An agent using the MCP fetch server (which has no SSRF protection of its own) can be instructed to fetch internal URLs, cloud metadata, etc.

Fix: Validate URL parameters in MCP tool arguments before passing them to MCP servers.

Disclosure

I am reporting this responsibly. Both issues have proof-of-concept code and detailed analysis ready. Please advise on your preferred disclosure process.

Environment

• crewai: latest (main branch, commit 7baf8f9)
• crewai-tools: latest
• Python 3.11+

[ashusnapx]

@joaomdmoura @greysonlalonde @lorenzejay @lucasgomide @bhancockio @vinibrsl @theCyberTech @pythonbyte

TL;DR — Two SSRF vulnerabilities fixed with industry-grade engineering:

1. DNS Rebinding TOCTOU killed dead

• validate_url() resolved DNS, checked IP, returned URL string. Then requests.get() resolved DNS again — classic TOCTOU window where attacker flips DNS from public IP to 169.254.169.254 (cloud metadata) between check and connect.
• Fix: validate_url_and_resolve() returns ValidatedURL(url, resolved_ip). safe_get() now uses a PinnedIPAdapter (custom requests.HTTPAdapter) that pins TCP to the pre-resolved IP. DNS resolved exactly once, zero TOCTOU window. Works across redirects too — each redirect target gets its own pinned session.

2. MCP SSRF bypass patched

• MCP tool wrappers passed agent-controlled args (including URLs) directly to MCP servers — zero validation. An agent told "fetch http://169.254.169.254/latest/meta-data/" via an MCP fetch tool would happily comply.
• Fix: _validate_mcp_tool_args_for_urls() recursively scans string args for URLs (http, https, file), extracts them via regex, and runs each through the SSRF guard. Server URLs validated too. Blocks nested dicts, lists, the works.

51 tests, 0 failures. Ruff clean. PR: #6519