Description
A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment.
INFO
Published Date :
2025-11-18T00:00:00.000Z
Last Modified :
2025-11-18T17:06:05.260Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2025-63604 vulnerability.
| Vendors | Products |
|---|---|
| Baryhuang |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-63604.
