Aws Resources Mcp Server
Approved changes feed: RSS · Atom
cpe:2.3:a:baryhuang:aws_resources_mcp_server:0.1.0:*:*:*:*:*:*:*part: a version: 0.1.0 update: *
| Vendor | Baryhuang (877f638e-58b7-53ea-9394-3ddbf37965b7) |
|---|---|
| Product | Aws Resources Mcp Server (f7632ea1-bafe-5956-b29f-9e42a24c5a05) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/baryhuang/mcp-server-aws-resources-python |
purl2cpe | 2026-07-28 16:40:57.029490 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-63604 |
vulnerable | 2026-06-08 07:39:17.680766 |
Details available
A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment.
Published: 2025-11-18T00:00:00.000Z
Updated: 2025-11-18T17:06:05.260Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.