CVE-2025-63604 — MEDIUM (6.5)

Vulnerability Description

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Baryhuang	Aws Resources Mcp Server	0.1.0

Related Weaknesses (CWE)

CWE-77

References

https://github.com/baryhuang/mcp-server-aws-resources-python/issues/8ExploitThird Party AdvisoryIssue Tracking

FAQ

What is CVE-2025-63604?

CVE-2025-63604 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulner...

How severe is CVE-2025-63604?

CVE-2025-63604 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-63604?

Check the references section above for vendor advisories and patch information. Affected products include: Baryhuang Aws Resources Mcp Server.