| शीर्षक | hekmon8 Jenkins-server-mcp 0.1.0 Server-Side Request Forgery |
|---|
| विवरण | A Server-Side Request Forgery (SSRF) vulnerability was identified in Jenkins-server-mcp 0.1.0. The issue exists in multiple MCP tools within src/index.ts, such as get_build_status and get_build_log, which accept a user-controlled jobPath argument. This argument is concatenated into an Axios request URL without sufficient validation (e.g., /${args.jobPath}/...). By supplying a jobPath that starts with a leading slash (e.g., /127.0.0.1:7777/), an attacker can force the application to treat the URL as protocol-relative, effectively hijacking the request destination. This allows an attacker to bypass the intended JENKINS_URL configuration to probe internal network services, access cloud metadata endpoints, or interact with other private infrastructure resources. |
|---|
| स्रोत | ⚠️ https://github.com/hekmon8/Jenkins-server-mcp/issues/4 |
|---|
| उपयोगकर्ता | ccccccctfi (UID 97498) |
|---|
| सबमिशन | 11/05/2026 10:17 AM (5 महीनों पहले) |
|---|
| संयम | 31/05/2026 06:02 PM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367569 [hekmon8 Jenkins-server-mcp 0.1.0 get_build_status/get_build_log/trigger_build src/index.ts jobPath अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|