Summary
MCP Atlassian can be manipulated into sending server-local files to an attacker-selected or insufficiently restricted Atlassian attachment endpoint. The risk arises when HTTP transport is enabled, read-only mode is disabled, and requests can omit an authenticated identity while controlling service URL headers.
Affected context
The vulnerability occurs in MCP Atlassian HTTP transport deployments where write-capable attachment operations are available and request identity or destination validation is insufficient. A caller may influence Atlassian service headers and provide a server-local file path to attachment functionality, allowing the MCP process to act as an unintended intermediary.
Exploit preconditions
- Attack surface: MCP Atlassian HTTP transport endpoints
- Required access: Ability to submit requests to the MCP server; an Authorization identity may not be required under the affected configuration
- Trigger point: Invocation of Confluence or Jira attachment-upload functionality
- Required configuration:
READ_ONLY_MODE=false - Destination condition: The attacker-controlled destination must be public or permitted by the configured domain allowlist
- Why exploitation is possible: The server trusts caller-controlled service headers and uses its own access to read and transmit a local file
Why this happens
The underlying issue is a confused-deputy design in which a privileged server performs an outbound file upload on behalf of an insufficiently authenticated caller. Caller-controlled service headers influence the destination, while the attachment operation accepts a local file path without adequately binding the request to an authorized identity or trusted resource policy. This maps primarily to CWE-441: Unintended Proxy or Intermediary ('Confused Deputy'), with related exposure and path-handling concerns represented by CWE-200 and CWE-22.
Potential impact
- Sensitive server-local files may be disclosed to an external endpoint
- Application credentials, configuration data, or cached artifacts could be exposed
- The MCP process may make unintended outbound requests
- Security boundaries between callers and Atlassian services could be weakened
- The incident could support follow-on compromise if exposed files contain secrets
General mitigation guidance
Mitigation should focus on preventing the server from acting as an unauthorized file-transfer intermediary.
Common defensive patterns include:
- Require strong authentication and authorization for every attachment operation
- Reject requests that lack a verified caller identity
- Derive service destinations from trusted server-side configuration rather than client-controlled headers
- Enforce strict destination validation, including scheme, host, and redirect controls
- Restrict attachment sources to approved application-managed directories instead of arbitrary local paths
- Apply least-privilege filesystem permissions and run the MCP process with minimal network access
- Disable write-capable attachment operations by default where they are not required
- Use narrowly scoped allowlists and treat them as defense in depth rather than authorization
How teams detect issues like this
Detection can combine code inspection, runtime monitoring, and policy enforcement:
- Search for attachment APIs that accept caller-controlled file paths or destination headers
- Review HTTP handlers for missing authentication checks and authorization decisions
- Identify outbound requests whose target host is derived from request headers
- Monitor unexpected uploads, external destinations, and access to sensitive local paths
- Add static-analysis and code-review rules for unrestricted file reads, open redirects, and confused-deputy flows
- Enforce network-egress policies and filesystem access policies for MCP service processes
- Use automated security review tools to flag trust-boundary violations and missing identity propagation
