| タイトル | ddfourtwo sentry-selfhosted-mcp 0.4.0 Server-Side Request Forgery |
|---|
| 説明 | The ddfourtwo/sentry-selfhosted-mcp MCP server exposes a raw_sentry_api tool that accepts a caller-controlled endpoint argument. The tool passes this endpoint directly to axiosInstance HTTP methods. Because Axios accepts absolute URLs, an attacker-controlled endpoint such as http://127.0.0.1:7777/ssrf-test causes the MCP server to send an outbound request to that URL instead of restricting the request to the configured Sentry base URL.
In a local reproduction, the server was started with SENTRY_URL set to http://127.0.0.1:9 and SENTRY_AUTH_TOKEN set to a dummy token. Calling raw_sentry_api with method GET and endpoint http://127.0.0.1:7777/ssrf-test caused a local listener on port 7777 to receive the request. The listener observed the path /ssrf-test, User-Agent axios/1.8.4, Host 127.0.0.1:7777, and Authorization: Bearer poc_dummy_token_do_not_use_real.
This demonstrates server-side request forgery through raw_sentry_api. It also shows that the configured Sentry Authorization header may be forwarded to an attacker-controlled endpoint, which can result in credential exposure if a real token is configured. |
|---|
| ソース | ⚠️ https://github.com/ddfourtwo/sentry-selfhosted-mcp/issues/2 |
|---|
| ユーザー | cccccccti (UID 96695) |
|---|
| 送信 | 2026年07月12日 16:57 (2 月 ago) |
|---|
| モデレーション | 2026年08月26日 21:05 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 395941 [ddfourtwo sentry-selfhosted-mcp 0.4.0 raw_sentry_api endpoint 特権昇格] |
|---|
| ポイント | 20 |
|---|