GHSA-5648-RGJ9-V224: Multiple Security Control Bypasses in @zereight/mcp-gitlab

The @zereight/mcp-gitlab package implements a Model Context Protocol (MCP) server designed to interface large language model (LLM) agents with GitLab APIs. By presenting GitLab functionalities as semantic tools, the server allows automated agents to perform actions such as retrieving pipeline traces, writing issues, or querying data through GraphQL.

In versions prior to 2.1.30, a collection of five distinct security flaws (designated F1 through F5) compromises the authorization, confidentiality, and availability guarantees of this integration. The most severe defects allow malicious actors, or prompt-injected LLM agents, to execute unauthorized write operations and bypass the configured read-only mode boundaries.

These vulnerabilities expand the attack surface from typical local execution to remote unauthorized action orchestration, session exhaustion, and DNS rebinding. The combination of local state maintenance and weak validation in HTTP and Server-Sent Events (SSE) channels exposes the system to active exploitation under specific configurations.

The F1 vulnerability is an authorization bypass located within utils/graphql-query.ts and the "execute_graphql" tool handler in index.ts. The implementation attempts to enforce a read-only environment, controlled by the GITLAB_READ_ONLY_MODE configuration parameter, by parsing and rejecting any incoming query containing write operations.

The normalization function stripGraphQLCommentsAndStrings strips comments and strings from the GraphQL query but fails to sanitize commas. Under the GraphQL syntax specification, commas are treated as insignificant whitespace and are skipped by parsers. The server attempts to detect mutations or subscriptions using the regular expression /(?:^|[};]\s*)(mutation|subscription)\b/ on the normalized query.

By prefixing a write operation with a leading comma (for example, ,mutation { ... }), an attacker or compromised agent prevents the regex from matching because the write keyword is preceded by a comma rather than the start of the string (^), a closing brace (}), or a semicolon (;). The downstream GitLab GraphQL engine ignores the comma and executes the mutation, bypassing safety controls. Furthermore, the "execute_graphql" tool handler fails to call rejectIfProjectScopedDeployment(), allowing operations on projects outside the defined GITLAB_ALLOWED_PROJECT_IDS allow-list.

The second flaw, F2, is a deployment-conditional authentication bypass on the /mcp HTTP endpoint. When STREAMABLE_HTTP=true is set, the server only checks if MCP-layer authentication is configured when initialized with a Personal Access Token or job token. If initialized via OAuth device flow or cookie-jar pathways, the validation is skipped, exposing /mcp to unauthenticated network actors while signing requests with the server's valid credentials.

Flaw F3 involves the Server-Sent Events (SSE) transport protocol, which lacks origin and host-header verification by default and does not enforce authentication unless SSE_AUTH_TOKEN is defined. Because the server typically binds to loopback interfaces, this omission permits DNS rebinding attacks. An external site visited by the host user can issue commands to the local SSE endpoint, invoking GitLab actions on behalf of the user.

Flaw F4 represents an unauthenticated transport-exhaustion denial-of-service vulnerability. The validateToken function only performs structural checks on tokens without validating their active status upstream. An unauthenticated attacker can flood /mcp with structurally correct garbage tokens, allocating sessions up to the MAX_SESSIONS limit (1000). These dead sessions persist for one hour by default, denying access to legitimate requests.

The remediation implemented in version 2.1.30 addresses these issues across multiple files. In utils/graphql-query.ts, the regular expression was modified to match leading commas only when they occur at the very beginning of the document string, ensuring that nested fields containing matching substrings are not falsely classified as write operations while blocking prefix evasion.

// Before patch:
// return /(?:^|[};]\s*)(mutation|subscription)\b/.test(normalized);
 
// After patch in v2.1.30:
return /(?:^(?:,\s*)?|[};]\s*)(mutation|subscription)\b/.test(normalized);

To remediate the DNS rebinding vulnerability (F3) on the SSE server, a validation middleware was introduced. This middleware checks both the Host and Origin headers against a strictly defined allow-list containing localhost and configured server URLs. If the headers do not match, the connection is closed immediately with a 403 Forbidden status.

const allowedHosts = new Set([
  `${HOST}:${PORT}`,
  `127.0.0.1:${PORT}`,
  `localhost:${PORT}`,
  `[::1]:${PORT}`,
]);
// Middleware rejects requests whose headers do not match allowedHosts

For the session exhaustion vulnerability (F4), the patch replaces local syntactical token validation with active upstream verification. The server now attempts to authenticate against the GitLab /api/v4/user endpoint before allocating an internal session object, neutralizing unauthenticated DoS attempts.

Exploitation of these vulnerabilities varies based on transport configuration. For the F1 GraphQL bypass, an attacker uses a prompt injection to force the LLM agent to submit a comma-prefixed GraphQL payload. Since the agent's safety middleware evaluates this as read-only, the request is permitted, and the backend processes the write command.

// Local validation bypass replication
const vulnerableRegex = /(?:^|[};]\s*)(mutation|subscription)\b/;
const bypassPayload = ",mutation { deleteProject(input: { id: 1 }) { errors } }";
const isBlocked = vulnerableRegex.test(bypassPayload);
console.log("Is Blocked:", isBlocked); // Outputs: false

In the case of F4, session exhaustion is accomplished by issuing rapid HTTP requests containing synthetic tokens to the /mcp initialization endpoint. Because the server fails to check these tokens upstream prior to session creation, it populates the active session pool to its maximum capacity, causing service denial.

# Denial of service payload execution
for i in $(seq 1 1000); do
  curl -s -o /dev/null http://127.0.0.1:3002/mcp \
    -H 'Content-Type: application/json' \
    -H 'Private-Token: dummytokenstringlongenough' \
    -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05"}}'
done

The collective impact of these vulnerabilities is classified as High, with an advisory CVSS v3.1 score of 8.1. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This score reflects the ability of network-adjacent or remote actors to perform high-privilege actions on the GitLab platform.

The integration of LLM agents introduces a unique attack vector through flaw F5. Because the server returns raw pipeline log traces to the LLM agent, an attacker can embed malicious instructions inside public CI job traces. When the agent processes these traces, it interprets the embedded commands as system-level instructions, potentially leveraging F1 to delete repositories or exfiltrate private code.

Furthermore, the lack of host and origin header validation on the SSE server exposes internal developer environments to cross-site request forgery and DNS rebinding attacks. This allows untrusted web origins to issue arbitrary MCP commands, effectively bridging the host's browser context with the local MCP-GitLab service instance.