SurfSense SSRF and Command Injection Vulnerabilities

Command injection in MODSetter SurfSense through version 2.0.3 allows an authenticated low-privilege user to execute arbitrary shell commands on the host by sending a crafted payload to the /api/search-source/connectors/mcp/test endpoint within the MCP Connector Integration component. Exploitation is remote with low complexity and no user interaction, but requires valid credentials and a reachable/configured MCP connector feature. Publicly available exploit code exists (a proof-of-concept was published to a public gist and referenced by VulDB), and the vendor was contacted about the disclosure but did not respond; no official patched version is confirmed, and the signals on severity conflict (vendor CVSS 4.0 base 5.3 versus our assessed CVSS 3.1 vector of 8.8).

Server-side request forgery (SSRF) in MODSetter SurfSense 0.0.36 and earlier allows an authenticated, low-privilege user to make the backend dereference attacker-influenced URLs by supplying crafted content to the Document Export Feature (the export_document route in surfsense_backend/app/routes/editor_routes.py). Because the server-side export/conversion pipeline (pypandoc/typst) fetches or processes references embedded in document content, a malicious export request can cause the server to issue outbound requests to resources it can reach. Publicly available exploit code exists and the flaw is remotely reachable, but the assessed impact is confidentiality-limited (VC:L) with no integrity or availability effect, making this a genuinely low-severity issue despite remote reachability.