Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim

Details https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamablehttptransport.rb#L260-L278

Victim starts a legitimate MCP session and receives session ID abc-123 Attacker obtains the session ID (various means - network sniffing, logs, etc. out of scope for this analysis) Attacker sends POST to /messages/abc-123 with a tool call Server accepts the request (no ownership validation!) Server executes the tool and sends response to victim's SSE stream Victim receives attacker's response, thinking it's legitimate

PoC attackerclient.py legitimateclient.py

Prerequisites

1. Python 3.8+ 2. Install dependencies: requests

Running the Demo

1. Terminal 1: Start the Ruby MCP Server

ruby streamablehttpserver.rb

Makes use of https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamablehttpserver.rb This server has a tool call notificationtool which the clients call

2. Terminal 2: Start Victim Client

python3 legitimateclient.py

3. Terminal 3 - Attacker Client:

Copy the session ID from Terminal 1 and run:

bash python3 attackerclient.py abc-123-def-456 4. Back to Terminal 2 - Victim sees the injected response:

Impact

- Integrity: HIGH - Attacker can execute unauthorized tools and modify state - Availability: LOW - Attacker can disrupt victim's session with injected responses

Additional Details Session Hijacking Protection in MCP Implementations

The MCP specification recommends - "MCP servers SHOULD bind session IDs to user-specific information".

User Binding - Comparison other SDKs csharp-sdk

- https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L36 - https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L95-L98

Go-sdk

- https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L66 - https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L316-L320

Comparison with the Stream Replacement vulnerability

Stream Replacement https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35

- Target: SSE stream connection - Attack Vector: GET /mcp - What happens to Victim: The connection is disconnected and doesn't receive reponses

Session Poisoning

- Target: Tool execution - Attack Vector: POST /mcp - What happens to Victim: The connection stays connected and receives responses of tool calls by attacker