T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned Browser Extension Bridges MCP Requests into an Active Browser Session<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9–17 and 39–43 **Vulnerability Type**: Unpinned third-party browser dependency with access to a session-bound security context **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown easyTable is a restaurant table-booking system. Each restaurant has a public booking widget at `https://book.easytable.com/book/?id=<restaurantId>` — the `id` is the only identifier (there's no login). This MCP drives that widget through the user's own signed-in, Cloudflare-cleared browser tab via the fetchproxy bridge; the site blocks any server-side request. ## Setup (one time) 1. Install the fetchproxy browser extension (https://github.com/chrischall/fetchproxy). ``` ```markdown `create` and `modify` submit a Cloudflare Turnstile token the MCP reads from the widget tab's hidden input, so a `book.easytable.com/book/?id=<id>` tab must be open and loaded when you confirm. The token is single-use and expires after a few minutes; if a create fails on the token, reload the tab and retry. `cancel` needs no token. ``` ### Technical Analysis The Skill directs users to install a browser extension directly from a third-party GitHub repository, but it does not pin the dependency to an immutable commit, verified release, version, checksum, or signed installation artifact. Consequently, the component installed by a user may differ from the component originally reviewed. This dependency crosses a sensitive trust boundary because it bridges MCP operations into the user's active, Cloudflare-cleared browser tab. The documentation also states that the MCP reads a Turnstile token from a hidden input and uses the bridge to perform booking operations involving customer names and mobile numbers. The browser-based bridge appears necessary to the declared functionality because the service reportedly blocks server-side requests. However, requiring an unpinned extension with access to an active browser context exceed ...[truncated 2405 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the browser extension to an immutable, reviewed commit and a specific release version. 2. Distribute a reproducible, signed extension package and publish a cryptographic checksum for verification. 3. Document the extension's complete permission manifest and remove permissions not required for easyTable operations. 4. Restrict host access to `https://book.easytable.com/*` and reject arbitrary destination URLs. 5. Limit the bridge protocol to explicit reservation operations rather than allowing unrestricted browser-context fetches. 6. Prevent cookies, authorization headers, raw Turnstile tokens, and unrelated page content from being returned in MCP responses or written to logs. 7. Validate that the active tab matches the expected HTTPS origin and restaurant widget path before reading page data or issuing requests. 8. Preserve the existing confirmation gate for create, modify, and cancel operations, and display the destination restaurant and affected booking data before approval. 9. Define a reviewed update process, security contact, revocation procedure, and rollback mechanism for compromised extension releases. 10. Add automated tests verifying origin restrictions, permission boundaries, sensitive-data redaction, and rejection of requests targeting unrelated hosts. ]]>