The response at line 84-86 sets Content-type: text/html but does not include Content-Security-Policy, X-Content-Type-Options, or X-XSS-Protection headers:
Send the link to the victim (via email, chat, or any channel). When the victim clicks the link while their OAuth setup wizard is running, the JavaScript executes in their browser context.
Step 3 -- Verify with a simpler payload:
# Start the setup wizard (victim's machine)
# uv run mcp-atlassian --oauth-setup
# From attacker's machine (or same network):
curl "http://<victim-ip>:8080/callback?error=%3Cscript%3Ealert(document.domain)%3C/script%3E"
JavaScript execution in the victim's browser context during the OAuth setup flow.
While the callback server is short-lived (only active during initial setup), the exposure window is meaningful because:
The server binds to all interfaces, making it accessible from the local network.
The setup wizard waits up to 300 seconds (5 minutes) for the callback (line 174).
During this window, any crafted request triggers the XSS.
An attacker on the same network could potentially intercept or manipulate the OAuth authorization code, since the callback also handles code and state parameters on the same endpoint.
Recommended Fix
1. HTML-escape the message before injecting into the template:
# src/mcp_atlassian/utils/oauth_setup.py
import html
def _send_response(self, message: str, status: int = 200) -> None:
"""Send response to the browser."""
self.send_response(status)
self.send_header("Content-type", "text/html")
self.send_header("X-Content-Type-Options", "nosniff")
self.send_header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'")
self.end_headers()
# Escape user-controlled content before HTML injection
safe_message = html.escape(message)
html_content = f"""
...
<div class="message {"success" if status == 200 else "error"}">
<p>{safe_message}</p>
</div>
...
"""