| Titolo | ddfourtwo sentry-selfhosted-mcp 0.4.0 Server-Side Request Forgery |
|---|
| Descrizione | The ddfourtwo/sentry-selfhosted-mcp MCP server exposes a raw_sentry_api tool that accepts a caller-controlled endpoint argument. The tool passes this endpoint directly to axiosInstance HTTP methods. Because Axios accepts absolute URLs, an attacker-controlled endpoint such as http://127.0.0.1:7777/ssrf-test causes the MCP server to send an outbound request to that URL instead of restricting the request to the configured Sentry base URL.
In a local reproduction, the server was started with SENTRY_URL set to http://127.0.0.1:9 and SENTRY_AUTH_TOKEN set to a dummy token. Calling raw_sentry_api with method GET and endpoint http://127.0.0.1:7777/ssrf-test caused a local listener on port 7777 to receive the request. The listener observed the path /ssrf-test, User-Agent axios/1.8.4, Host 127.0.0.1:7777, and Authorization: Bearer poc_dummy_token_do_not_use_real.
This demonstrates server-side request forgery through raw_sentry_api. It also shows that the configured Sentry Authorization header may be forwarded to an attacker-controlled endpoint, which can result in credential exposure if a real token is configured. |
|---|
| Fonte | ⚠️ https://github.com/ddfourtwo/sentry-selfhosted-mcp/issues/2 |
|---|
| Utente | cccccccti (UID 96695) |
|---|
| Sottomissione | 12/07/2026 16:57 (2 mesi fa) |
|---|
| Moderazione | 26/08/2026 21:05 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 395941 [ddfourtwo sentry-selfhosted-mcp 0.4.0 raw_sentry_api endpoint escalationi di privilegi] |
|---|
| Punti | 20 |
|---|