| शीर्षक | pixelsock directus-mcp 1.0.0, Commit 77758625355d105364eeaeac9afec2f743fe369b Server-Side Request Forgery |
|---|
| विवरण | A server-side request forgery (SSRF) vulnerability (CWE-918) has been identified in directus-api-extended (directus-mcp) version 1.0.0, specifically within the uploadFile MCP tool. The tool accepts a user‑supplied fileUrl argument and passes it directly to axios.get without URL allowlisting, private‑address blocking, or redirect validation. An attacker with network access to the MCP interface can cause the server to make arbitrary outbound HTTP requests to loopback, internal, or attacker‑controlled destinations, potentially leading to information disclosure or further exploitation. No fixed version is available at the time of reporting.
|
|---|
| स्रोत | ⚠️ https://github.com/pixelsock/directus-mcp/issues/13 |
|---|
| उपयोगकर्ता | BruceJqs (UID 97404) |
|---|
| सबमिशन | 18/04/2026 08:02 AM (2 महीनों पहले) |
|---|
| संयम | 03/05/2026 06:04 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 360904 [pixelsock directus-mcp 1.0.0 MCP Interface index.ts validateUrl fileUrl अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|