SiYuan note-taking app — MCP http_request tool leaks plaintext secrets via attacker-controlled destination URL

SiYuan versions before v3.8.0 interpolate secret placeholders directly into the destination URL parameter of the http_request MCP tool. Because the resulting URL is fetched server-side without validating the destination host, an MCP client can supply an attacker-controlled URL and cause the stored secret's plaintext value to be exfiltrated to that host with no user confirmation.

This is a concrete example of the MCP tool-egress + secret-resolution exfiltration pattern flagged as a priority risk by the MCP project itself: any agentic tool that can both resolve credentials and make outbound network calls is a direct exfiltration primitive when destination control is attacker-influenced or client-controlled.

An MCP client (or an agent manipulated via indirect prompt injection) crafts a request to the http_request MCP tool with an attacker-controlled destination URL containing secret placeholders; SiYuan interpolates the actual plaintext secret value into that URL before making the outbound request, sending it to any public host without confirmation.

SiYuan before v3.8.0 (http_request MCP tool)

Upgrade to SiYuan v3.8.0 or later; disable/restrict the http_request MCP tool; enforce destination allowlists and egress controls on tools that can resolve secrets.