D365Fo Mcp Server
Monthly
Unauthenticated network access to D365 F&O MCP Server instances prior to version 1.11.0 exposes indexed proprietary X++ source code and metadata through the /mcp JSON-RPC endpoint. The officially documented Azure one-click deployment (infrastructure/azuredeploy.json and infrastructure/main.bicep) defaults the optional apiKey parameter to an empty string and passes it into the App Service API_KEY setting; with that value empty, src/middleware/apiKeyAuth.ts lets requests through without authentication while src/index.ts binds the listener to 0.0.0.0, so any deployer who leaves the key blank and adds no network restrictions or upstream authentication publishes the server to the internet. Attackers can then invoke read/search tools (search, get_object_info, batch_get_info, extension_info, security_info, find_references, find_event_handlers) to harvest business logic, extension and event-handler wiring, and security-role and privilege structure; the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) matching CWE-306, and no public exploit was identified at time of analysis.
Unauthenticated network access to D365 F&O MCP Server instances prior to version 1.11.0 exposes indexed proprietary X++ source code and metadata through the /mcp JSON-RPC endpoint. The officially documented Azure one-click deployment (infrastructure/azuredeploy.json and infrastructure/main.bicep) defaults the optional apiKey parameter to an empty string and passes it into the App Service API_KEY setting; with that value empty, src/middleware/apiKeyAuth.ts lets requests through without authentication while src/index.ts binds the listener to 0.0.0.0, so any deployer who leaves the key blank and adds no network restrictions or upstream authentication publishes the server to the internet. Attackers can then invoke read/search tools (search, get_object_info, batch_get_info, extension_info, security_info, find_references, find_event_handlers) to harvest business logic, extension and event-handler wiring, and security-role and privilege structure; the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) matching CWE-306, and no public exploit was identified at time of analysis.