Description

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component add_attachment_from_public_url. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T21:16:59.363Z",
  "pubdate": "2026-08-09T21:16:59.363Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the KS-GEN-AI jira-mcp-server version 0.2.0. The vulnerability resides within the add_attachment_from_public_url component, specifically in the axios.get function located in src/index.ts. This security flaw stems from insufficient validation and sanitization of user-supplied input provided via the imageUrl argument.\nSuccessful exploitation of this vulnerability allows an attacker to manipulate the imageUrl parameter to induce the server into initiating arbitrary HTTP GET requests toward internal or external resources. Depending on network architecture and internal service configurations, this capability can expose sensitive internal metadata services, private network interfaces, or restricted backend endpoints normally inaccessible from the external perimeter.\nThe risk implication is rated as significant due to the potential exposure of internal network topologies and confidential data stores. The attack requires a local approach to execute the exploitation vector. The project maintainers were notified early through an issue report but have not yet provided an official response or patch to address the reported vulnerability.",
  "technicalDetails": "The vulnerability is classified as Server-Side Request Forgery (SSRF) and manifests within the src/index.ts file of the KS-GEN-AI jira-mcp-server component add_attachment_from_public_url. The root cause of the flaw is the insecure handling of the imageUrl argument passed directly into the axios.get function without prior structural validation, scheme enforcement, or domain whitelisting.\nDuring standard operations, the add_attachment_from_public_url function is designed to fetch a remote file using a provided URL and attach it to a Jira issue. However, the absence of input filtering allows an adversary with local access to supply arbitrary Uniform Resource Identifiers, including loopback addresses (127.0.0.1), internal RFC 1918 IP blocks, or metadata service endpoints (e.g., 169.254.169.254).\nThe exploitation flow begins when the vulnerable function processes the malicious imageUrl argument. The underlying Axios HTTP client executes an outbound request using the attacker-controlled URI. Because the server processes the request on behalf of the application, it bypasses standard perimeter firewalls and Network Address Translation (NAT) boundaries that would normally restrict direct client access to internal resources.\nThe affected version is strictly 0.2.0. The authentication and privilege requirements depend on the execution context of the local interface exposing the vulnerable component, but the attack vector fundamentally requires a local approach. Network exposure is primarily internal to the host or container environment where the MCP server executes, but the resulting SSRF grants the application a pivot point into adjacent internal networks.\nPost-exploitation impact includes the potential retrieval of sensitive configuration files, interaction with internal microservices lacking authentication, unauthorized data exfiltration, or potential denial of service if resource-intensive internal endpoints are targeted repeatedly. The payload behavior directly mirrors standard HTTP requests generated by the Axios library, leveraging whatever network protocols and ports are specified within the manipulated URL argument."
}