Description

A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-09T07:17:04.000Z",
  "pubdate": "2026-08-09T07:17:04.000Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the aliyun alibabacloud-dataworks-mcp-server product up to version 1.0.43. The security flaw exists within the ReadResourceRequestSchema function located in the src/resources/initResources.ts file. By manipulating the request.params.uri argument, remote unauthenticated attackers can force the server to initiate unauthorized outbound network requests to arbitrary destinations. This vulnerability exposes internal network infrastructure, potentially leading to unauthorized data exposure, internal service discovery, or further pivoting within the internal network perimeter. The project was notified via an issue report but has not yet provided a responsive patch or remediation.",
  "technicalDetails": "The vulnerability resides in the src/resources/initResources.ts file, specifically inside the ReadResourceRequestSchema function of the aliyun alibabacloud-dataworks-mcp-server up to version 1.0.43. The root cause of the flaw is the improper validation, sanitization, and handling of user-supplied input passed via the request.params.uri argument. When processing resource read requests, the application accepts a URI parameter without adequately restricting the scheme, host, or destination targets to expected internal or authorized domains.\nExploitation of this vulnerability is achieved remotely without requiring prior authentication or elevated privileges. An attacker crafts a malicious request where the request.params.uri argument contains a manipulated Uniform Resource Identifier, pointing to internal network resources (such as loopback addresses, local network services, or cloud metadata endpoints) or external systems controlled by the attacker.\nThe attack flow proceeds as follows: First, the remote threat actor transmits an input payload containing the maliciously crafted URI to the vulnerable application endpoint. Second, the ReadResourceRequestSchema function parses the input without enforcing strict allowlists or destination validation. Third, the underlying server process dereferences the supplied URI by initiating an outbound network connection using the protocol specified in the request. Finally, the server processes the response or returns data related to the internal resource back to the caller, thereby completing the SSRF payload execution.\nPost-exploitation impact includes the potential enumeration of internal services, bypassing network access controls (firewalls) that isolate the internal network from the public internet, and potential access to cloud metadata services to harvest sensitive instance credentials."
}