| शीर्षक | 021is elvix-sdk 0.10.1 Server-Side Request Forgery |
|---|
| विवरण | A server-side request forgery (SSRF) vulnerability (CWE-918) has been identified in all MCP tools exposed by 021is elvix-sdk 0.10.1, commit 682cc8bbd631d692172e1d2856b238d073e88e5f. The default read-only mode exposes 24 tools, all of which are affected; administrative/non-read-only mode enables an additional 64 affected tools, for a total of 88. The shared MCP request handler in src/mcp/index.ts accepts an attacker-controlled path argument and passes it to new URL(path, baseUrl) without restricting the resulting scheme, host, or port. Supplying an absolute URL replaces the trusted baseUrl, after which the server sends the request with its configured Authorization: Bearer <apiKey> header. An attacker with access to the MCP interface can therefore make requests to loopback interfaces, internal services, cloud metadata endpoints, or attacker-controlled hosts and disclose the configured Elvix API key. A working exploit has demonstrated an arbitrary request to a local listener together with the Bearer credential. No fixed version is available at the time of reporting. |
|---|
| स्रोत | ⚠️ https://github.com/Xh1Xxhg/public_exp/issues/4 |
|---|
| उपयोगकर्ता | Xh1Xxhg (UID 90906) |
|---|
| सबमिशन | 27/08/2026 03:59 AM (2 महीनों पहले) |
|---|
| संयम | 10/10/2026 03:30 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416197 [021is elvix-sdk तक 0.10.1 MCP Request src/mcp/index.ts path अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|