| शीर्षक | TencentCloudBase CloudBase-MCP 2.16.1 Server-Side Request Forgery |
|---|
| विवरण | A server-side request forgery (SSRF) vulnerability (CWE-918) has been identified in the interactive server component of CloudBase MCP, specifically within mcp/src/interactive-server.ts. The HTTP endpoint POST /api/open-url accepts an attacker-controlled url value from the request body and passes it directly to openUrl() and subsequently to open() without validation or allowlisting. The server listens on x.x.x.x by default, making the endpoint reachable beyond loopback in many deployments. An attacker with network access to this endpoint can coerce the affected host into opening arbitrary URLs, enabling outbound requests to attacker‑controlled or internal destinations. Version 2.16.1 is confirmed affected, and no fixed version is available at the time of reporting. |
|---|
| स्रोत | ⚠️ https://github.com/TencentCloudBase/CloudBase-MCP/issues/509 |
|---|
| उपयोगकर्ता | BruceJin (UID 96538) |
|---|
| सबमिशन | 10/04/2026 06:01 PM (6 महीनों पहले) |
|---|
| संयम | 27/04/2026 05:35 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359821 [TencentCloudBase CloudBase-MCP तक 2.17.0 open-url API Endpoint interactive-server.ts openUrl req.body.url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|