How it was found

The Burp Suite MCP (Model Context Protocol) server on port 9876 lacks proper origin validation and CORS protection, enabling DNS rebinding attacks to bypass the Same-Origin Policy.

Pre-Requisites: attackers need to trick a victim who has Burp Suite installed with MCP Server enabled to open a malicious link . On that link domain, the attackers need to host malicious webpage

Step2: Setup a DNS server for a domain that you controls that answers the first DNS request on this domain with the IP of a server he controls (in this example 192.168.80.154), and all other DNS requests with 127.0.0.1. One way to do this is to use the https://github.com/mogwailabs/DNSrebinder and launching it like this: python3 dnsrebinder.py --domain rebind.mydomain.eu. --rebind 127.0.0.1 --ip 192.168.1.3 --counter 1 --udp

On IP Attacker needs to host a webserver that serves malicious web page. See attached html

Serve malicious page

python3 -m http.server 8080

Step1: Setup DNS Rebinding:

1. Visit: https://lock.cmpxchg8b.com/rebinder.html
2. Enter IP where web server with malicious web page would be hosted (in my case I hosted on localhost so enterd private IP)
3. Click generate to generate rebinding hostname. in my case it was: 7f000001.c0a80103.rbndr.us

Step2: Setup Server with Malicious page:

1. start webserver that server malicious page with python3 -m http.server 9876 (I am using same port as Burp MCP Server). Since test was done from localhost, I am temporarily turning OFF MCP server so that there is no port conflict.
2. Once DNS rebinding is done, stop/kill web server
3. Start Burp Suit's MCP Server, JS code will now try to connect with MCP Server

Attached Index.html contains POC code.

Step3: Actual POC Flow Once Web page URL is opened on machine which would look something like: http://7f000001.c0a80103.rbndr.us/, It loads embedded malicious JS Script which does following:

1. Establishes connection to MCP Server and fetches session ID which will be used in subsequent interactions.
2. Calls MCP server's send_http1_request tool to initiate http request to any internal/external hosts
3. Retrieves http history using get_proxy_http_history

This essentially enables any remote attacker to not only access Burp's MCP Server tools to but also initiate SSRF requests to company internal sites which are not accessible otherwise.

Impact

This allows malicious websites to:

1. Connect to the victim's local MCP server (127.0.0.1:9876)
2. Use the send_http1_request MCP tool to make arbitrary HTTP requests
3. Access internal networks, localhost services, and cloud metadata endpoints
4. Retrieve full HTTP responses including sensitive data