Fm Mcp Servers
Monthly
Server-side request forgery in feedmob fm-mcp-servers 0.0.3 allows a locally authenticated attacker to manipulate the `downloadUrl` argument in the `downloadReport` function, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled internal or external targets. Exploitation is constrained to local access only (AV:L), significantly limiting the practical attack surface, though a public proof-of-concept is available via GitHub issue #198. No vendor patch exists; the vendor has not responded to the coordinated disclosure.
Server-side request forgery in feedmob fm-mcp-servers 0.0.3 allows a locally authenticated attacker to manipulate the `downloadUrl` argument in the `downloadReport` function, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled internal or external targets. Exploitation is constrained to local access only (AV:L), significantly limiting the practical attack surface, though a public proof-of-concept is available via GitHub issue #198. No vendor patch exists; the vendor has not responded to the coordinated disclosure.