Security: FIRECRAWL_API_URL SSRF + API key leakage to attacker-controlled server

[Correctover]

Summary

The firecrawl-mcp-server passes the FIRECRAWL_API_URL environment variable directly to the FirecrawlApp client without any URL validation, enabling SSRF and API key exfiltration.

Vulnerability 1: SSRF via FIRECRAWL_API_URL (HIGH)

File: src/index.ts (line ~421)

const config: any = {
  ...(process.env.FIRECRAWL_API_URL && {
    apiUrl: process.env.FIRECRAWL_API_URL,
  }),
};

The apiUrl is passed directly to new FirecrawlApp(config) with no validation of:

• URL scheme (no http/https enforcement)
• Private/internal IP blocking (169.254.169.254, 10.x, 172.16.x, 192.168.x, 127.x)
• DNS rebinding protection

An attacker who can control the FIRECRAWL_API_URL env var (e.g., via container orchestration, CI/CD pipeline, or config injection) can redirect all API calls to internal services.

Vulnerability 2: API key leakage to attacker-controlled URL (HIGH)

When FIRECRAWL_API_URL points to an attacker server, the API key (from Authorization: Bearer header or FIRECRAWL_API_KEY env) is sent in every request to that URL. The FirecrawlApp sends the API key as a header to whatever apiUrl is configured.

Vulnerability 3: Scrape tool URL SSRF (MEDIUM)

The firecrawl_scrape tool accepts user-provided URLs. When combined with a self-hosted instance pointing to an internal endpoint, this enables internal network scanning.

Recommendation

Add URL validation: enforce http/https scheme, block private IPs (RFC1918, link-local 169.254.x, loopback 127.x), and add DNS rebinding protection.

[Correctover]

Hi Firecrawl team — I'm Wang Guigui from Correctover, the official reference implementation of the CCS (MCP Runtime Security Conformance Standard).

I audited 20+ MCP frameworks this week and found the same SSRF + env inheritance pattern across all of them. Firecrawl has better auth design than most (OAuth introspection, keyless mode), but the FIRECRAWL_API_URL SSRF is a unique risk for your self-hosted deployments.

If you'd like, I can provide a free CCS compliance audit report for firecrawl-mcp-server — covering all runtime security vectors (transport auth, SSRF, env isolation, input validation, output filtering).

CCS spec: https://github.com/Correctover/ccs

Happy to discuss.