CVE-2026-57496

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

Published

2026-06-18

Modified

2026-07-21

Aliases

GHSA-hxpf-9xvq-wph8

Sources

github-advisory

Summary

## REST Path Traversal Bypasses Token Redaction in netlicensing-mcp ### Summary The `netlicensing_get_product` MCP tool in `netlicensing-mcp` interpolates a caller-controlled `product_number` argument directly into a REST URL path without any validation. Passing `../token` as the product number causes `httpx` to normalize `/product/../token` into `/token`, silently redirecting the request to the NetLicensing token endpoint instead of the intended product endpoint. The response is then serialized through the generic `_wrap_json` wrapper rather than the token-specific `_wrap_json_token_read` wrapper, bypassing all APIKEY `number` and SHOP `shopURL` redaction. An authenticated MCP client can recover plaintext API key values that the token read tools intentionally mask, including admin-level APIKEY credentials. ### Details The vulnerability is a path traversal (CWE-22) that exploits the interaction between unsanitized string interpolation and `httpx`'s WHATWG URL normalization. **Source — `src/netlicensing_mcp/tools/products.py:22`** ```python async def get_product(product_number: str) -> dict: """Get a single product by its number.""" return strip_output_fields(await nl_get(f"/product/{product_number}")) ``` `product_number` is inserted directly into the REST path with no validation. A value of `../token` produces the path `/product/../token`. **Sink — `src/netlicensing_mcp/client.py:143`** ```python async def nl_get(path: str, params: dict[str, str] | None = None) -> dict[str, Any]: client = _get_client() url = f"{BASE_URL}{path}" ... r = await client.get(url, headers=_headers(), params=params or {}) ``` `httpx` constructs the full URL as `{BASE_URL}/product/../token` and, per WHATWG URL normalization rules applied to absolute URLs, resolves it to `{BASE_URL}/token`. The HTTP request is therefore sent to the NetLicensing `/core/v2/rest/token` endpoint. **Redaction bypass — `src/netlicensing_mcp/server.py:336` and `src/netlicensing_mcp/redaction.py:180-239`** The tool handler wraps the response via `_wrap_json(entity, "Product")`, which calls only the generic `_json()` redaction. The token-specific path `_wrap_json_token_read()` → `redact_token_read()` is never invoked. The function `redact_token_read()` at `redaction.py:180-239` is the only code that masks APIKEY `number` and SHOP `shopURL` fields; because it is not on this code path, the raw API key value is returned verbatim in the MCP tool output. **Complete data flow:** 1. `server.py:312-321` — MCP dispatcher receives attacker-controlled `product_number` and calls `products.get_product(product_number)`. 2. `tools/products.py:22` — value interpolated into `f"/product/{product_number}"` without validation. 3. `client.py:143` — `url = f"{BASE_URL}{path}"`; `httpx` normalizes `../` and sends request to `/token` endpoint. 4. `server.py:336` — response wrapped as `"Product"` via `_wrap_json`, not `_wrap_json_token_read`. 5. `server.py:160-165` — generic `_json()` redaction applies only default-field masking. 6. `redaction.py:180-239` — `redact_token_read()` with APIKEY/SHOP-specific masking is never reached. ### PoC **Prerequisites** - Python 3.10+ - `netlicensing-mcp` 0.1.5 (or local commit `c8a3fec`) installed or available via `PYTHONPATH` - `httpx`, `python-dotenv`, `mcp[cli]` installed **Option A — Docker (recommended, reproduces Phase 2 result)** ```bash # Build from the repository root (requires repo/ and vuln-001/ directories) docker build -t netlicensing-vuln-001 \ -f vuln-001/Dockerfile \ reports/pypiAi_1561_Labs64__NetLicensing-MCP/ # Run — exit code 0 confirms the vulnerability docker run --rm netlicensing-vuln-001 ``` **Option B — Direct Python** ```bash cd /path/to/Labs64__NetLicensing-MCP PYTHONPATH=src python3 - <<'PY' import asyncio, json, threading from http.server import BaseHTTPRequestHandler, HTTPServer seen = [] secret = "actual-api-key-value-5678" class Handler(BaseHTTPRequestHandler): def do_GET(self):

Affected packages

Remediation: Upgrade to 0.1.8 or later.

References

• https://github.com/advisories/GHSA-hxpf-9xvq-wph8