GHSA-5wf4-jqxh-8gm3: SSRF
Summary
The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation.
Affected Package
- Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before fix commit 5cd697dfce91 - Patched versions: >= commit 5cd697dfce91
Details
In main.py, processauthenticationheaders() extracts URLs from ASGI headers without validation. In dependencies.py, getjirafetcher() creates JiraConfig with url=jiraurlheader directly. There is no validateurl call, no IP range check, no hostname validation.
The fix adds URL validation to some paths but the header-based URL extraction in processauthenticationheaders() still passes raw URLs through. The derived config objects use the header URL directly and the fetcher makes HTTP requests to that URL.
PoC
python jiraurlheader = headers.get(b"x-atlassian-jira-url") jiraurlstr = jiraurlheader.decode("latin-1") if jiraurlheader else None serviceheaders["X-Atlassian-Jira-Url"] = jiraurlstr
Steps to reproduce: 1. git clone https://github.com/sooperset/mcp-atlassian /tmp/mcp-atlassiantest 2. cd /tmp/mcp-atlassiantest && git checkout 5cd697dfce91~1 3. pip install -e . 4. python3 poc.py
Expected output: VULNERABILITY CONFIRMED User-supplied URLs from HTTP headers passed directly to JiraConfig/JiraFetcher with no SSRF validation
Impact
An attacker can set X-Atlassian-Jira-Url: http://169.254.169.254/latest/meta-data/ to access AWS instance metadata, or target any internal service. The server makes authenticated HTTP requests to the attacker-specified URL.
Suggested Remediation
Validate all user-supplied URLs against an allowlist of permitted hostnames or reject private/loopback/link-local IP ranges. Consider requiring server-side configuration of allowed Atlassian instance URLs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Upgrade
Upgrade
mcp-atlassianto a version that resolves this vulnerability.Patch 5cd697dfce91 - Configuration
Require server-side configuration of permitted Atlassian instance URLs, and validate all user-supplied URLs against the allowlist or reject private, loopback, and link-local IP ranges.
mcp-atlassian allowed Atlassian instance URLs = allowlist of permitted hostnames
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when an attacker can send requests with the X-Atlassian-Jira-Url or X-Atlassian-Confluence-Url headers. The middleware accepts these ASGI headers and uses their values as API client URLs without hostname, IP-range, or URL validation.
What does an attacker need to control?
The attacker needs to control either of the Atlassian URL request headers. The application then creates derived configuration objects using the supplied URL, and the fetcher makes HTTP requests to that destination.
Does the referenced fix commit fully address the header-based path?
No. The provided details state that the fix adds URL validation to some paths, but _process_authentication_headers() still passes raw header URLs through to the derived configuration and fetcher.