Executive brief
The CKAN MCP Server's MQA (data quality) tools contain a validation flaw that allows attackers to redirect requests to arbitrary hosts despite an intended restriction to dati.gov.it. By exploiting improper regex validation, an attacker can craft malicious URLs that pass validation while actually targeting attacker-controlled servers, enabling response spoofing and indirect injection of malicious content into model outputs.
Technical details
The vulnerability is a permissive regular expression (CWE-625) combined with improper input validation (CWE-20) in the `isValidMqaServer()` function in src/tools/quality.ts. The regex `/^https?:\/\/(www\.)?dati\.gov\.it/i` is anchored only at the start and lacks a host boundary, allowing three bypass vectors: (1) domain suffix injection (e.g., `https://dati.gov.it.attacker.com/x` passes regex but targets attacker.com), (2) subdomain prefix injection (e.g., `http://dati.gov.it.evil.example/api` targets evil.example), and (3) URL userinfo abuse (e.g., `https://dati.gov.it@attacker.com/x` targets attacker.com). The validated URL then flows into `makeCkanRequest()`, issuing HTTP requests to the attacker-controlled host whose response is returned to the caller. This enables response spoofing, SSRF escalation beyond the intended domain restriction, and in agentic AI contexts, indirect prompt injection. Patch version 0.4.112 fixes the issue by parsing the URL and validating the hostname directly instead of regex matching.
Affected products
- ondata ckan-mcp-server < 0.4.112
Timeline
- 2026-09-02: disclosed: Advisory published on GitHub Advisory Database
- 2026-09-02: patched: Fixed in version 0.4.112