An unauthenticated server-side request forgery vulnerability in AlejandroArciniegas mcp-data-vis allows remote attackers to bypass security filters and access sensitive internal network services.

The application fails to properly sanitize user-supplied URLs in the web scraper module before passing them to the axios request library. Because the validation logic only blocks a limited subset of local IP ranges, an unauthenticated remote attacker can bypass these checks to reach prohibited internal services, such as cloud metadata endpoints or private administrative interfaces.

This vulnerability poses a significant risk to organizational confidentiality and infrastructure integrity. By leveraging the application as a proxy, an attacker can scan internal networks, exfiltrate data from restricted cloud metadata services, or interact with internal APIs that lack secondary authentication. While the CVSS score is 7.3, the ability for an unauthenticated user to pivot into internal segments elevates the potential for lateral movement and further compromise of sensitive backend systems.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected MCP tools to only trusted, authenticated users. If possible, disable the web scraper functionality until the vendor provides a secure update that implements robust IP address filtering and denylisting of all private and link-local address spaces.

Proactive Monitoring: Review web server and application logs for unusual outbound requests originating from the server, specifically targeting internal IP ranges such as 172.16.0.0/12, 169.254.0.0/16, and private IPv6 addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an egress filtering policy that strictly blocks the server from initiating connections to internal or non-public network destinations.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's GitHub issue report.

Given the availability of a public proof-of-concept and the high risk of internal network exposure, this vulnerability requires urgent attention. Organizations currently utilizing mcp-data-vis must implement strict network egress controls and restrict access to the vulnerable endpoints until a vendor-supplied patch is released and verified.