In the MCP server jshookmcp, the network domain implements a SSRF authorization policy that blocks private, loopback, link‑local, and reserved targets for most raw network tools. The ICMP probe and traceroute tools, however, bypass this policy by resolving the target and invoking native OS commands, allowing an MCP client to probe internal addresses even when other raw network tools are restricted. This enables the server to reveal internal reachability and route mapping to an attacker, potentially facilitating further exploitation within the internal network.

The vulnerability affects vmoranv's jshookmcp server, version 0.3.1. The issue is fixed in version 0.3.2, so only installations running 0.3.1 are impacted.

The CVSS score of 4.3 reflects a moderate severity risk. EPSS is not available and the vulnerability is not listed in CISA KEV. An MCP client with adequate permissions can remotely trigger ICMP or traceroute requests to local addresses, providing an attacker with internal reachability information. The attack requires only network domain access and the privilege to execute those network tools, but does not require higher privileges beyond the client’s normal operation.