Server-Side Request Forgery Vulnerability in sentry-selfhosted-mcp

[ccccccctiiiiiiii-lab]

Server-Side Request Forgery Vulnerability in sentry-selfhosted-mcp

1) CNA / Submission Type

• Submission type: Report a vulnerability (CVE ID request)
• Reporter role: Independent security researcher
• Report date: Jul 8, 2026

2) Reporter Contact

• Reporter name: cccccccti
• Reporter email: ccccccc_Ti@outlook.com
• Permission to share contact with vendor: Yes

3) Vendor / Product Identification

• Vendor: ddfourtwo
• Product: sentry-selfhosted-mcp
• Repository: https://github.com/ddfourtwo/sentry-selfhosted-mcp
• Affected component(s):
• src/index.ts

4) Vulnerability Type

• CWE: CWE-918 (Server-Side Request Forgery)
• Short title: SSRF via raw_sentry_api endpoint argument

5) Affected Versions

• Confirmed affected: 0.4.0 (79b748a confirmed affected)
• Suspected affected range: revisions containing the same request-to-sink flows listed below
• Fixed version: Not available at time of report

6) Vulnerability Description

A server-side request forgery (SSRF) vulnerability has been identified in sentry-selfhosted-mcp. The raw_sentry_api MCP tool accepts a caller-controlled endpoint argument and passes it directly to Axios request methods. Axios can process absolute URLs in request methods, allowing an attacker who can invoke the tool to make the MCP server send HTTP requests to attacker-selected destinations rather than only to the configured Sentry API. Manual reproduction was confirmed before this report was generated. The commit 79b748a is confirmed affected, with no fixed version available at the time of reporting.

7) Technical Root Cause

1. js/request-forgery-from-request
   • Source: src/index.ts:902 (raw_sentry_api tool handler) and src/index.ts:910 (args.endpoint)
   • Sinks: src/index.ts:921, src/index.ts:924, src/index.ts:927, and src/index.ts:930
   • Sink code: response = await this.axiosInstance.get(args.endpoint, config); and equivalent post, put, and delete calls.

8) Attack Prerequisites

• Attacker can invoke the raw_sentry_api MCP tool.
• The server can make outbound HTTP requests to attacker-chosen or internal destinations.
• No effective validation rejects absolute URLs, loopback destinations, link-local destinations, private ranges, or redirects.

9) Proof of Concept / Reproduction Guidance

This proof of concept provides a concise, CVE-style reproduction example for the reported issue.

1. Reproduction request

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"raw_sentry_api","arguments":{"method":"GET","endpoint":"http://127.0.0.1:8000/ssrf-proof"}}}

2. Validation

• Run a local HTTP listener on 127.0.0.1:8000.
• Invoke raw_sentry_api with the absolute URL shown above.
• Confirm that the listener receives an outbound request from the MCP server process.

10) Security Impact

• Confidentiality: High if internal services, metadata endpoints, or authenticated internal APIs are reachable.
• Integrity: Low to High depending on reachable internal endpoints and allowed HTTP methods.
• Availability: Low to Medium through repeated requests or interaction with internal services.
• Scope: Changed if the server can access otherwise unreachable network resources.

11) CVSS v3.1 Suggestion

• Suggested vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
• Suggested base score: 9.0 (Critical)
• Adjust PR upward if the vulnerable tools are strictly admin-only and strongly authenticated.

12) Workarounds / Mitigations

• Enforce strict endpoint allowlists for Sentry API paths.
• Reject absolute URLs in raw_sentry_api; accept only normalized relative API paths.
• Block loopback, link-local, RFC1918, and metadata destinations after DNS resolution and redirect handling.
• Add authentication, authorization, logging, and rate limiting on sensitive MCP handlers.

13) Recommended Fix

• Eliminate the request-to-sink data flow documented above.
• Normalize endpoint as a relative path and join it with the configured Sentry base URL safely.
• Add URL validation and regression tests proving absolute URLs and internal destinations are rejected.
• Publish a maintainer security advisory once a patch is released.

14) References

• Repository: https://github.com/ddfourtwo/sentry-selfhosted-mcp
• Reviewed source file: src/index.ts
• CWE-918: https://cwe.mitre.org/data/definitions/918.html

15) Credits

• Discoverer: cccccccti
• Discovery method: Static analysis (CodeQL) plus repository source-code audit and manual reproduction

16) Additional Notes for Form Mapping

• Audit verdict: Likely exploitable: attacker-controlled endpoint values can reach outbound Axios request sinks.
• Dynamic exploit replay status: manually reproduced by the reporter before report generation.
• Maintainer should validate release mapping before coordinated disclosure.