A First Measurement Study on Authentication Security in Real-World Remote MCP Servers
对现实世界远程MCP服务器认证安全性的首次测量研究
Huijun Zhou, Xiaohan Zhang, Haozhe Zhang, Haoyang Zhang, Mi Zhang, Min Yang
AI总结 本研究首次测量了现实世界远程MCP服务器的认证安全性,发现40.55%的服务器未进行认证,OAuth是主要的授权机制,但存在新的攻击面,识别出9种具体漏洞类型,并通过负责任的披露获得了9个CVE ID。
Comments 15 pages, 9 figures
详情
模型上下文协议(MCP)正成为连接大型语言模型(LLMs)与外部服务的常见接口。远程部署日益重要,因为代理连接到用户关联的在线服务,如社交、生产力和金融服务。在这些部署中,MCP客户端与远程服务器之间的认证边界成为安全关键,但仍未被深入研究。我们进行了首次对现实世界远程MCP服务器认证安全性的测量研究。我们识别出7,973个活跃的远程MCP服务器,发现40.55%的服务器未进行认证。在已认证的服务器中,OAuth是访问远程服务的主要授权机制,且在MCP生态系统中常见的三个特征:开放客户端环境、动态客户端注册和委托授权。这些特征使MCP部署区别于传统OAuth,并引入了新的攻击面。基于这一观察,我们推导出包含三个MCP特定类别和传统OAuth误配置的认证漏洞分类法,总计四个类别和九种具体漏洞类型。为了在大规模上评估这些漏洞,我们实现了结合被动流量检查和主动动态探测的半自动化检测框架。将其应用于119个可测试的现实OAuth启用MCP服务器,发现每个服务器至少存在一种漏洞,总共识别出325种漏洞,其中动态客户端注册漏洞影响了96.6%的测试服务器。许多这些漏洞可能导致敏感信息泄露和账户接管。通过负责任的披露,我们获得了9个CVE ID。我们的发现揭示了MCP生态系统中普遍存在的认证弱点,并强调了对加固OAuth基于的远程部署的紧迫需求。
The Model Context Protocol (MCP) is emerging as a common interface connecting large language models (LLMs) with external services. Remote deployments are becoming increasingly important as agents connect to user-linked online services, such as social, productivity, and financial services. In such deployments, the authentication boundary between MCP clients and remote servers becomes security-critical, yet remains underexplored. We present the first measurement study of authentication security in real-world remote MCP servers. We identify 7,973 live remote MCP servers, finding that 40.55% expose tools without authentication. Among authenticated servers, OAuth is the dominant authorization mechanism for reaching remote services, and OAuth deployments in the MCP ecosystem commonly exhibit three characteristics: open client environments, dynamic client registration, and delegated authorization. These characteristics distinguish MCP deployments from traditional OAuth and introduce new attack surfaces. Guided by this observation, we derive a taxonomy of authentication flaws comprising three MCP-specific categories and conventional OAuth misconfigurations, for a total of four categories and nine concrete flaw types. To evaluate these flaws at scale, we implement a semi-automated detection framework that combines passive traffic inspection with active dynamic probing. Applying it to 119 testable real-world OAuth-enabled MCP servers, we find that each server exhibits at least one flaw, with a total of 325 flaws identified, among which dynamic client registration flaws affect 96.6% of tested servers. Many of these flaws can lead to sensitive information leakage and account takeover. Through responsible disclosure, we obtained 9 CVE IDs. Our findings expose pervasive authentication weaknesses in the MCP ecosystem and underscore the urgent need for hardened OAuth-based remote deployments.