| 标题 | ddfourtwo sentry-selfhosted-mcp 0.4.0 Server-Side Request Forgery |
|---|
| 描述 | The ddfourtwo/sentry-selfhosted-mcp MCP server exposes a raw_sentry_api tool that accepts a caller-controlled endpoint argument. The tool passes this endpoint directly to axiosInstance HTTP methods. Because Axios accepts absolute URLs, an attacker-controlled endpoint such as http://127.0.0.1:7777/ssrf-test causes the MCP server to send an outbound request to that URL instead of restricting the request to the configured Sentry base URL.
In a local reproduction, the server was started with SENTRY_URL set to http://127.0.0.1:9 and SENTRY_AUTH_TOKEN set to a dummy token. Calling raw_sentry_api with method GET and endpoint http://127.0.0.1:7777/ssrf-test caused a local listener on port 7777 to receive the request. The listener observed the path /ssrf-test, User-Agent axios/1.8.4, Host 127.0.0.1:7777, and Authorization: Bearer poc_dummy_token_do_not_use_real.
This demonstrates server-side request forgery through raw_sentry_api. It also shows that the configured Sentry Authorization header may be forwarded to an attacker-controlled endpoint, which can result in credential exposure if a real token is configured. |
|---|
| 来源 | ⚠️ https://github.com/ddfourtwo/sentry-selfhosted-mcp/issues/2 |
|---|
| 用户 | cccccccti (UID 96695) |
|---|
| 提交 | 2026-07-12 16時57分 (2 月前) |
|---|
| 管理 | 2026-08-26 21時05分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 395941 [ddfourtwo sentry-selfhosted-mcp 0.4.0 raw_sentry_api endpoint 权限提升] |
|---|
| 积分 | 20 |
|---|