| 제목 | ddfourtwo sentry-selfhosted-mcp 0.4.0 Server-Side Request Forgery |
|---|
| 설명 | The ddfourtwo/sentry-selfhosted-mcp MCP server exposes a raw_sentry_api tool that accepts a caller-controlled endpoint argument. The tool passes this endpoint directly to axiosInstance HTTP methods. Because Axios accepts absolute URLs, an attacker-controlled endpoint such as http://127.0.0.1:7777/ssrf-test causes the MCP server to send an outbound request to that URL instead of restricting the request to the configured Sentry base URL.
In a local reproduction, the server was started with SENTRY_URL set to http://127.0.0.1:9 and SENTRY_AUTH_TOKEN set to a dummy token. Calling raw_sentry_api with method GET and endpoint http://127.0.0.1:7777/ssrf-test caused a local listener on port 7777 to receive the request. The listener observed the path /ssrf-test, User-Agent axios/1.8.4, Host 127.0.0.1:7777, and Authorization: Bearer poc_dummy_token_do_not_use_real.
This demonstrates server-side request forgery through raw_sentry_api. It also shows that the configured Sentry Authorization header may be forwarded to an attacker-controlled endpoint, which can result in credential exposure if a real token is configured. |
|---|
| 원천 | ⚠️ https://github.com/ddfourtwo/sentry-selfhosted-mcp/issues/2 |
|---|
| 사용자 | cccccccti (UID 96695) |
|---|
| 제출 | 2026. 07. 12. PM 04:57 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 26. PM 09:05 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 395941 [ddfourtwo sentry-selfhosted-mcp 0.4.0 raw_sentry_api endpoint 권한 상승] |
|---|
| 포인트들 | 20 |
|---|