CyberRota Analysis
AI-GeneratedVersions of python-utcp prior to 1.1.4 are vulnerable to a server-side request forgery (SSRF) flaw that allows attackers to exploit HTTP redirects without re-validation of the target URL. This can enable unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive information. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.