T09 · Insecure Skill Coding Practices
- Location
scripts/jira-reader.mjs:101- Finding
Unrestricted Jira Base URL Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
scripts/jira-reader.mjs, lines 101–107
Vulnerability Type: Server-Side Request Forgery (SSRF) through an unrestricted configuration URL
Risk Level: MediumVulnerable code:
js async function discoverCloudId() { const response = await fetch(`${config.baseUrl}/_edge/tenant_info`, { headers: { Accept: 'application/json' } }); if (!response.ok) throw new Error(`Could not discover Jira Cloud ID from JIRA_BASE_URL: HTTP ${response.status}`); const data = await response.json(); if (!data.cloudId) throw new Error('Could not discover Jira Cloud ID from JIRA_BASE_URL'); config.cloudId = data.cloudId; return config.cloudId; }config.baseUrloriginates fromJIRA_BASE_URL, including values loaded from the configured environment file. Before use, it is only normalized by removing trailing slashes:js config.baseUrl = config.baseUrl.replace(/\/+$/, '');Technical Analysis
discoverCloudId()performs a server-sidefetch()against a URL derived directly from configuration controlled throughJIRA_BASE_URL. The implementation does not:- Require the
https:protocol. - Restrict the hostname to the intended Jira Cloud tenant or an approved
*.atlassian.netdomain. - Reject URL-embedded credentials or unexpected ports.
- Block loopback, private, link-local, or other internal network destinations.
- Disable redirects or validate every redirect destination.
Therefore, a party able to influence the process environment or the loaded
.envfile can cause the Skill to make an HTTP request from the Agent's network context to an unintended destination.The authenticated Jira request itself is sent to the fixed HTTPS origin
https://api.atlassian.com, so this flaw does not directly send the Jira Basic authorization header to the attacker-controlled discovery endpoint. Nevertheless, unrestricted network discovery exceeds the minimu ...[truncated 1602 chars]- Require the
- Remediation
View remediation
Remediation Suggestions
- Parse
JIRA_BASE_URLwithnew URL()and reject malformed values. - Require the
https:protocol. - Reject embedded usernames and passwords, URL fragments, unexpected paths, and non-default ports.
- Prefer an exact allowlist containing the organization's expected Jira Cloud hostname. If wildcard support is essential, validate hostname boundaries carefully and permit only legitimate
*.atlassian.nettenant hosts. - Disable automatic redirects where supported, or validate every redirect destination against the same protocol and hostname policy before following it.
- Resolve the hostname and reject loopback, private, link-local, multicast, and reserved IP ranges for both IPv4 and IPv6. Repeat validation after DNS resolution and for redirect targets to reduce DNS rebinding risk.
- Prefer requiring
JIRA_CLOUD_IDin controlled deployments so the discovery request is unnecessary. - Add automated tests covering HTTP URLs, localhost, private IP addresses, IPv6 loopback, embedded credentials, unexpected ports, deceptive hostname suffixes, and redirects to prohibited destinations.
- Parse