Alibabacloud Dataworks Mcp Server
Monthly
Server-Side Request Forgery in Alibaba Cloud's alibabacloud-dataworks-mcp-server (versions up to 1.0.43) enables authenticated remote attackers to manipulate the server into issuing arbitrary HTTP requests to internal or external targets. The vulnerability resides in the ReadResourceRequestSchema function within src/resources/initResources.ts, where the request.params.uri argument is accepted without sufficient validation or restriction. A proof-of-concept exploit exists (CVSS 4.0 E:P), no vendor patch has been released as of disclosure, and the project maintainer had not responded to the issue report at time of filing.
Server-Side Request Forgery in Alibaba Cloud's alibabacloud-dataworks-mcp-server (versions up to 1.0.43) enables authenticated remote attackers to manipulate the server into issuing arbitrary HTTP requests to internal or external targets. The vulnerability resides in the ReadResourceRequestSchema function within src/resources/initResources.ts, where the request.params.uri argument is accepted without sufficient validation or restriction. A proof-of-concept exploit exists (CVSS 4.0 E:P), no vendor patch has been released as of disclosure, and the project maintainer had not responded to the issue report at time of filing.