Ckan Mcp Server
Monthly
Server-side request forgery in CKAN MCP Server (ondata/@aborruso ckan-mcp-server) before version 0.4.108 allows an attacker who can influence the caller-supplied server_url parameter to force the server to issue requests to loopback addresses and to the cloud instance metadata service at 169.254.169.254. The flaw is the third bypass of the same validateServerUrl guard: because that guard only inspects the hostname string and never resolves DNS, any hostname that resolves to an internal address (documented examples lvh.me to 127.0.0.1 and *.nip.io to IMDS) slips through, and exploitation realistically requires prompt injection into content the victim's AI assistant processes while the MCP server is connected (CVSS UI:R). No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, though a proof-of-concept for an earlier, related SSRF variant in the same package is published; impact is highest for cloud-hosted deployments where IMDS returns IAM credentials.
Server-side request forgery in CKAN MCP Server (ondata/@aborruso ckan-mcp-server) before version 0.4.108 allows an attacker who can influence the caller-supplied server_url parameter to force the server to issue requests to loopback addresses and to the cloud instance metadata service at 169.254.169.254. The flaw is the third bypass of the same validateServerUrl guard: because that guard only inspects the hostname string and never resolves DNS, any hostname that resolves to an internal address (documented examples lvh.me to 127.0.0.1 and *.nip.io to IMDS) slips through, and exploitation realistically requires prompt injection into content the victim's AI assistant processes while the MCP server is connected (CVSS UI:R). No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, though a proof-of-concept for an earlier, related SSRF variant in the same package is published; impact is highest for cloud-hosted deployments where IMDS returns IAM credentials.