Facebook Ads Mcp Server
Monthly
Server-Side Request Forgery in gomarble-ai facebook-ads-mcp-server 0.1.0 allows low-privileged remote attackers to issue arbitrary outbound HTTP requests through the server by supplying a crafted URL to the fetch_pagination_url function in server.py. The function passed user-controlled input directly to requests.get() with no scheme, hostname, or port validation, enabling access to internal network resources, cloud metadata endpoints, or other hosts reachable from the server's network position. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a patch is available via GitHub commit 4e53875.
Server-Side Request Forgery in gomarble-ai facebook-ads-mcp-server 0.1.0 allows low-privileged remote attackers to issue arbitrary outbound HTTP requests through the server by supplying a crafted URL to the fetch_pagination_url function in server.py. The function passed user-controlled input directly to requests.get() with no scheme, hostname, or port validation, enabling access to internal network resources, cloud metadata endpoints, or other hosts reachable from the server's network position. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a patch is available via GitHub commit 4e53875.