PT-2026-105839 · Pypi · Mcp-Attlasian

Publicado

2026-10-01

·

Atualizado

2026-10-01

CVSS v4.0

8.3

Alta

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Summary

The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation.

Affected Package

  • Ecosystem: PyPI
  • Package: mcp-atlassian
  • Affected versions: all versions before fix commit 5cd697dfce91
  • Patched versions: >= commit 5cd697dfce91

Details

In main.py, process authentication headers() extracts URLs from ASGI headers without validation. In dependencies.py, get jira fetcher() creates JiraConfig with url=jira url header directly. There is no validate url call, no IP range check, no hostname validation.
The fix adds URL validation to some paths but the header-based URL extraction in process authentication headers() still passes raw URLs through. The derived config objects use the header URL directly and the fetcher makes HTTP requests to that URL.

PoC

python
jira url header = headers.get(b"x-atlassian-jira-url")
jira url str = jira url header.decode("latin-1") if jira url header else None
service headers["X-Atlassian-Jira-Url"] = jira url str
Steps to reproduce:
  1. git clone https://github.com/sooperset/mcp-atlassian /tmp/mcp-atlassian test
  2. cd /tmp/mcp-atlassian test && git checkout 5cd697dfce91~1
  3. pip install -e .
  4. python3 poc.py
Expected output:
VULNERABILITY CONFIRMED
User-supplied URLs from HTTP headers passed directly to JiraConfig/JiraFetcher with no SSRF validation

Impact

An attacker can set X-Atlassian-Jira-Url: http://169.254.169.254/latest/meta-data/ to access AWS instance metadata, or target any internal service. The server makes authenticated HTTP requests to the attacker-specified URL.

Suggested Remediation

Validate all user-supplied URLs against an allowlist of permitted hostnames or reject private/loopback/link-local IP ranges. Consider requiring server-side configuration of allowed Atlassian instance URLs.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-4084

Produtos afetados

Mcp-Attlasian