CyberRota Analysis
AI-GeneratedThe CKAN MCP Server prior to version 0.4.112 is vulnerable due to improper validation of the server_url parameter in the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools, which can allow an attacker to exploit the system by redirecting requests to a malicious host. This could lead to the delivery of spoofed responses, potentially compromising the integrity of data queries. Organizations using affected versions should prioritize upgrading to version 0.4.112 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.