Cross-Session Data Exposure via Caller-Controlled session_id

Project / Repository: arikusi/deepseek-mcp-server
Affected version / commit tested: 1.6.0 / 04f28be2c6e99d3d4e443a6ae37cc35f0a71554a
Vulnerability type: Authorization bypass / cross-session data exposure Authentication required: No

Summary

The process-global SessionStore accepts caller-supplied session_id values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via deepseek_sessions, then reuse a victim-controlled session_id in deepseek_chat to retrieve and continue the victim's conversation context.

Affected Code

• src/session.ts:42 - caller-controlled session IDs are looked up directly from the global in-memory map.
• src/session.ts:67 - a new session is stored under the caller-controlled ID without ownership binding.
• src/session.ts:109 - getMessages() retrieves messages for any supplied session ID.
• src/tools/deepseek-chat.ts:195 - deepseek_chat creates or reuses the supplied session_id.
• src/tools/deepseek-chat.ts:197 - previous messages are loaded from the supplied session_id.
• src/tools/deepseek-chat.ts:198 - previous messages are prepended into the attacker-controlled request.
• src/tools/deepseek-chat.ts:243 - attacker-provided user messages are appended into the reused session.
• src/tools/deepseek-chat.ts:245 - assistant responses are appended back into the reused session.
• src/tools/deepseek-sessions.ts:37 - deepseek_sessions list enumerates all active sessions.
• src/tools/deepseek-sessions.ts:53 - each enumerated session ID is rendered back to the caller.

PoC Overview

1. Create a victim conversation with session_id = "victim-session".
2. Call deepseek_sessions with action = "list" and observe that victim-session is disclosed.
3. Call deepseek_chat again with session_id = "victim-session" from a separate attacker flow.
4. The upstream request now includes the victim's prior messages before the attacker's message.

Validation Environment

Local runtime verification on Windows host with Node.js v24.11.1, using the repository code at the tested commit and a local mock DeepSeek client to capture the effective message list passed upstream.

Impact

Any reachable caller can enumerate active session IDs and read prior conversation history stored in memory for other callers within the same server process. The same flaw also allows attacker-controlled continuation of another user's session state.

Remediation

• Bind stored sessions to an authenticated transport session or other server-generated opaque identifier.
• Do not allow arbitrary user-supplied session_id values to select existing server-side state.
• Remove or restrict deepseek_sessions list so it does not disclose unrelated session IDs.
• Reject reuse of a session unless the caller proves ownership of that session.

Attached Evidence

01_deepseek-mcp-server_cross_session_data_exposure.txt

---

Patches (maintainer)

Fixed in 1.7.0. The HTTP transport's SessionStore is no longer a process-wide singleton: each MCP HTTP session gets its own store, injected into the deepseek_chat and deepseek_sessions tool handlers, so a session_id from one HTTP session cannot read, enumerate, or clear another session's state. STDIO transport was never affected (one process per client). Integration tests in src/transport-isolation.test.ts assert the isolation.

Affected versions >=1.4.2, <1.7.0 are deprecated on npm. Upgrade to 1.7.0 or later.

Workaround

If upgrading is not immediately possible, run in STDIO transport (unset TRANSPORT=http) or stop the HTTP server.

Credit

Reported independently by @232-323 and @2REBCat (tested against 1.6.0). The same root cause was found and fixed concurrently by the maintainer during a security audit, shipped in 1.7.0. All parties are credited as finders.

Note on severity

A connected client could read other clients' conversation history (C:H), inject messages into their sessions (I:L), and clear or delete other clients' sessions (A:L). Scope is unchanged: the impact stays within the application's own authorization boundary, which is a cross-tenant authorization bypass, so S:U is correct.