Description

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument image_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T11:16:40.597Z",
  "pubdate": "2026-08-17T11:16:40.597Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified within the download_image function of server.py in the Image-Toolkit-MCP-Server component of Kira-Pgr PromptShopMCP, affecting commits up to 5bc0cd17358e19a5415d11a531088170d7b81452.\nThe vulnerability allows remote attackers to manipulate the image_url argument, forcing the vulnerable server to dispatch arbitrary outbound HTTP requests to internal or external destinations.\nThis flaw exposes internal network resources, potentially leading to unauthorized data access, internal service enumeration, or further exploitation of restricted backend systems that are not directly exposed to the public internet.\nThe product utilizes a rolling release model, meaning specific fixed version identifiers are unavailable, and the project maintainers have not yet responded to early notifications regarding this issue.\nExploitation can be initiated remotely without requiring prior authentication, increasing the overall risk profile as public exploit material is currently available.",
  "technicalDetails": "The vulnerability resides in the download_image function located within the server.py file of the Image-Toolkit-MCP-Server component.\nThe root cause of the vulnerability is the lack of proper input validation, sanitization, and URL parsing restrictions on the image_url argument accepted by the application.\nWhen a user supplies a crafted input via the image_url parameter, the application attempts to retrieve the resource using an HTTP request without verifying whether the target destination resolves to a public address, loopback interface, or internal network segment.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the vulnerable endpoint, supplying a malicious URL within the image_url parameter, such as a loopback address (e.g., http://127.0.0.1/), internal metadata service endpoints, or internal intranet resources.\nThe server processes the input and initiates a backend outbound connection to the specified URL via the download_image routine.\nThe server then reads the response from the targeted internal or external resource, potentially leaking internal data back to the attacker or executing unintended state changes depending on how the retrieved content is handled.\nNetwork exposure is high as the vulnerability is reachable remotely, and exploitation requires no authentication or special privileges.\nThe post-exploitation impact includes the ability to map internal network infrastructure, access sensitive configuration files or metadata services running on localhost, and pivot attacks against internal hosts shielded behind network perimeter controls."
}