netlicensing-mcp Path Traversal in product_number Bypasses Token Redaction (GHSA-hxpf-9xvq-wph8)

How the attack works

The netlicensing_get_product tool takes a product_number parameter and drops it directly into a REST URL like /product/{product_number}. If an attacker passes '../token' (or its URL-encoded form '%2e%2e/token') instead of a real product number, the resulting path /product/../token gets normalized by the HTTP client to /token. The server returns the token endpoint's data but treats it as a product response, so it skips the code that would normally redact the secret. The result is the raw API key, shop URL, and console URL exposed in what looks like an ordinary product lookup response.

Netzilo detection

Why it matters

An attacker who can call this tool obtains a live NetLicensing API key and related admin URLs, which can be used to manage or abuse the victim's licensing account outside the MCP server entirely.

What you can do

• →Upgrade netlicensing-mcp past 0.1.5 or apply input validation on product_number before it reaches the REST call.
• →Reject any product_number value containing '..', '/', or their URL-encoded equivalents at the tool boundary.
• →Audit logs for netlicensing_get_product calls with non-alphanumeric or path-like product_number values.
• →Rotate any NetLicensing API keys that may have been exposed through this tool.

Known benign look-alikes

• A legitimate netlicensing_get_product call with a real alphanumeric product_number (e.g. product_number=PRD-001) that contains no ../ traversal.
• Documentation describing the /product/{number} and /token REST endpoints separately without a traversal payload joining them.
• Generic mention of the netlicensing-mcp server or its tools without the ../token product_number payload.

References

• https://agentthreatrule.org/en/rules/ATR-2026-01948

Related threats