Unauthenticated Remote Command Execution via SSE Transport

[dayzsec]

Summary

When scheduler-mcp is configured with SSE transport (--transport sse), the server exposes all MCP tools over HTTP without any authentication. An unauthenticated remote attacker who can reach the SSE port can create and execute arbitrary shell commands via add_command_task / run_task_now, achieving remote code execution with the privileges of the server process.

Affected Versions

• Latest commit 5a2015a (2025-07-24)
• All versions supporting SSE transport

Root Cause

The SchedulerServer class (mcp_scheduler/server.py) registers MCP tools via FastMCP without any authentication middleware. When started with SSE transport, the server binds an HTTP endpoint via uvicorn on the configured address/port.

Key issues:

1. No authentication mechanism exists — no API keys, tokens, OAuth, or passwords
2. No CORS headers returned by the server
3. No per-transport access control differentiation (stdio vs SSE expose identical tools)
4. No command allow-list, sandboxing, or confirmation gate
5. asyncio.create_subprocess_shell(shell=True) used for execution
6. README does not warn about SSE transport security implications

The FastMCP SDK supports auth settings in its constructor, but scheduler-mcp never configures them.

Proof of Concept

1. Server: python main.py --transport sse --address 0.0.0.0 --port 8080
2. Attacker: GET /sse → receives SSE session_id (no auth required)
3. POST /messages/?session_id=xxx → JSON-RPC tools/call add_command_task
4. POST /messages/?session_id=xxx → JSON-RPC tools/call run_task_now
5. Arbitrary shell command executed on host

Tested and confirmed with real runtime. Commands execute via asyncio.create_subprocess_shell(shell=True).

Impact

• Remote Code Execution: Arbitrary OS commands as the server process user
• SSRF: add_api_task allows forcing HTTP requests to internal services
• Information Disclosure: list_tasks, get_task, get_server_info expose configuration and execution history
• No authentication required for any of the above

Recommended Fix

1. Add authentication middleware using FastMCP auth parameter
2. Add --require-auth CLI flag, mandatory for SSE transport
3. Return proper CORS headers restricting cross-origin access
4. Add security section to README warning about SSE exposure
5. Consider --disable-command-tasks flag for SSE mode
6. Implement command allow-list or execution sandboxing

Environment

• scheduler-mcp commit: 5a2015a6cd9ebbef0feb1a382e762b2c5783a904
• MCP SDK: 1.27.1
• Python: 3.10.12
• OS: Ubuntu 22.04