PT-2026-105838 · Pypi · Mcp-Attlasian
Publicado
2026-10-01
·
Atualizado
2026-10-01
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Summary
The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validate url for ssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS record may have changed to point to an internal IP (127.0.0.1, 169.254.169.254, etc.). The SSRF redirect hook only validates redirect targets, not the initial connection.
Details
The vulnerability spans main.py (validation) and dependencies.py (use).
Step 1 -- URL validation at middleware time:
In src/mcp atlassian/servers/main.py:524-531, the URL from X-Atlassian-Jira-Url is validated:
if jira url str:
ssrf error = validate url for ssrf(jira url str)
if ssrf error:
# blocked
validate url for ssrf (src/mcp atlassian/utils/urls.py:113-116) resolves DNS and checks is global:
dns error = check dns resolution(hostname)
if dns error:
return dns error
Step 2 -- HTTP request happens later with a separate DNS resolution:
In src/mcp atlassian/servers/dependencies.py:544-562, a JiraFetcher is created with the attacker URL and makes HTTP requests to it. The SSRF redirect hook (attach ssrf hook=True) is applied but only checks redirect Location headers, not the initial connection target.
DNS rebinding timeline:
- Attacker sets up rebind.attacker.com with short TTL (1 second)
- First DNS resolution (validate url for ssrf): returns 1.2.3.4 (public) -- passes
- TTL expires
- Second DNS resolution (requests.get): returns 169.254.169.254 (metadata)
- HTTP request reaches internal IP, bypassing the SSRF check
PoC
Use a DNS rebinding service like rbndr.us. Send a request with X-Atlassian-Jira-Url set to a rebinding hostname (e.g., rebind-169.254.169.254-1.2.3.4.rbndr.us) and X-Atlassian-Jira-Personal-Token set to any value. With approximately 50% probability per attempt, the request reaches the internal metadata service.
Impact
- Cloud metadata access: Steal IAM credentials via 169.254.169.254
- Internal network scanning: Proxy requests to internal services
- AC:H: DNS rebinding is probabilistic and requires multiple attempts
- Limited to header pat branch: Only affects deployments accepting header-based PAT authentication
Recommended Fix
Pin DNS resolution: resolve the hostname once during validation, then connect to the resolved IP directly (with the original hostname in the Host header). This eliminates the TOCTOU gap between validation and use.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Mcp-Attlasian