Description
A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument Request can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
E
Physical
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
E
Physical
RL
X
RC
Required
Affected products
- BurtTheCoder / mcp-dnstwist1.0.0 – 1.0.0
- BurtTheCoder / mcp-dnstwist1.0.1 – 1.0.1
- BurtTheCoder / mcp-dnstwist1.0.2 – 1.0.2
- BurtTheCoder / mcp-dnstwist1.0.3 – 1.0.3
- BurtTheCoder / mcp-dnstwist1.0.4 – 1.0.4