Description

A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument pdf_file_path results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-20T21:16:55.597Z",
  "pubdate": "2026-09-20T21:16:55.597Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the pdf-tools-mcp component of the cowork_bench project.\nThe vulnerability resides in the ControlFlowNode function within local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py.\nBy manipulating the pdf_file_path argument, an unauthenticated remote attacker can force the server to initiate unauthorized requests to internal or external resources.\nThe risk implication is significant as it allows attackers to bypass network perimeters, scan internal infrastructure, or interact with metadata services in cloud environments.\nThe vulnerability is currently unpatched and active in all versions from 0717376 up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d.\nExploitation is possible remotely without requiring prior authentication, and the availability of public exploit material elevates the threat level to critical.",
  "technicalDetails": "The vulnerability is a classic Server-Side Request Forgery (SSRF) stemming from improper validation of user-supplied input used in file path handling operations. Within the ControlFlowNode function in local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py, the application accepts a pdf_file_path argument that is processed without sufficient sanitization or restriction against protocol schemes and host identifiers.\nThe root cause lies in the application's reliance on unsanitized input to point to resources that the server-side process is expected to handle as PDF files. Because the underlying code fails to enforce a whitelist of allowed file paths or restrict access to local filesystem or network resources, an attacker can supply crafted URIs or file paths.\nThe attack flow begins with the attacker identifying the target endpoint that triggers the ControlFlowNode function. By injecting malicious input into the pdf_file_path parameter, the attacker can manipulate the internal logic to cause the server to fetch a resource from a specified location. If the application environment or supporting libraries utilize standard URL handling, an attacker can provide URI schemes (e.g., file://, http://, gopher://) to reach internal targets that would otherwise be inaccessible from the public internet.\nSuccessful exploitation allows for server-side requests to be performed on behalf of the host, enabling the attacker to perform port scanning, fingerprint internal services, or retrieve sensitive configuration information from internal-only network endpoints. In cloud-native environments, this is frequently used to interact with the Instance Metadata Service (IMDS) to exfiltrate identity tokens or credentials.\nThe vulnerability is present in the codebase between commit 0717376 and commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Given the component's role within an MCP (Model Context Protocol) server environment, the risk is amplified as the server is inherently designed to facilitate interaction between agents and local data sources. The lack of input validation or an abstract file-system abstraction layer allows for directory traversal or arbitrary protocol usage, ultimately leading to full control over the egress traffic of the server process."
}