Description

A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T16:17:49.307Z",
  "pubdate": "2026-08-17T16:17:49.307Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the jae-jae fetcher-mcp component up to version 0.3.9. This security flaw exists within the URL Validation component and specifically impacts the fetch_url and fetch_urls functions. The vulnerability allows remote attackers to manipulate URL parameters and force the server to execute arbitrary outbound HTTP requests.\nThe primary impact of this vulnerability involves unauthorized access to internal resources, sensitive metadata endpoints, and network services isolated from the public internet. Given the specific file path reference to /latest/meta-data/iam/security-credentials/, the attack vector enables cloud environment metadata service exposure, potentially leaking IAM security credentials and sensitive configuration data.\nThe risk implication is critical, as exploitation can be executed remotely without prior authentication or special privileges, depending on the exposure of the application interface. The project maintainers have been notified via an issue report but have not yet provided an official patch or response.",
  "technicalDetails": "The vulnerability stems from insufficient URL validation and sanitization within the URL Validation component of jae-jae fetcher-mcp up to version 0.3.9. Specifically, the functions fetch_url and fetch_urls fail to adequately restrict target domains, IP addresses, or URL schemes prior to initiating network requests on behalf of the user.\nRoot Cause: The lack of a strict allowlist or robust input filtering mechanism allows untrusted user input to be processed directly by the underlying HTTP client libraries. Attackers can supply specially crafted URLs pointing to internal network endpoints or loopback addresses.\nExploitation Method and Attack Flow: An unauthenticated remote attacker initiates the attack by sending a malicious payload targeting the vulnerable fetch_url or fetch_urls functions. When the application processes the request, it attempts to fetch the resource specified by the manipulated URL. By targeting cloud metadata services, such as requesting /latest/meta-data/iam/security-credentials/, the application retrieves and returns sensitive internal metadata containing temporary security credentials.\nNetwork Exposure and Privileges: The vulnerability is exploitable remotely over the network. It does not require prior authentication or elevated privileges, making it highly accessible if the component's interface is exposed to untrusted clients or the public internet.\nPost-Exploitation Impact: Successful exploitation leads to severe confidentiality breaches. If the application runs within a cloud infrastructure environment (such as AWS, GCP, or Azure), leaking IAM security credentials via the metadata endpoint can allow the attacker to assume cloud roles, pivot laterally within the internal cloud environment, access cloud storage buckets, and compromise additional infrastructure assets."
}