| शीर्षक | atototo api-lab-mcp 0.2.1 Server-Side Request Forgery |
|---|
| विवरण | A server-side request forgery (SSRF) vulnerability (CWE-918) has been identified in api-lab-mcp, specifically within the MCP tools analyze_api_spec, generate_test_scenarios, and test_http_endpoint. An attacker with network access to the MCP/HTTP interface can supply maliciously crafted input through the source or url arguments, which flow unsanitized into outbound HTTP requests via fetch or axios. This allows the server to make arbitrary requests to internal services, cloud metadata endpoints, or other restricted destinations, potentially leading to unauthorized information disclosure and further compromise. Versions up to and including 0.2.1 are confirmed affected. |
|---|
| स्रोत | ⚠️ https://github.com/atototo/api-lab-mcp/issues/4 |
|---|
| उपयोगकर्ता | BruceJin (UID 96538) |
|---|
| सबमिशन | 26/03/2026 06:53 AM (7 महीनों पहले) |
|---|
| संयम | 08/04/2026 07:10 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 356288 [atototo api-lab-mcp तक 0.2.1 HTTP Interface src/mcp/http-server.ts source/url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|