Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft

Affected

• Repository: zereight/gitlab-mcp
• Affected versions: All versions through commit 74a8c83
• Patched versions: None at time of report

Severity

High. CVSS v3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

Description

When the environment variable ENABLE_DYNAMIC_API_URL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (new URL(dynamicApiUrl)) but applies no allowlist or hostname restriction. The server then attaches the victim's Private-Token to every outbound fetch that uses the redirected URL.

Any caller who can reach the HTTP transport can set X-GitLab-API-URL to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host.

The vulnerable code appears at two locations.

SSE handler (index.ts:11541):

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // no allowlist check
}

Streamable HTTP handler (index.ts:11787), inside parseAuthHeaders:

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  new URL(dynamicApiUrl);                          // syntax-only check
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // any reachable host accepted
}