mcp-sse Command Injection via `generate_payload`

[wing3e]

mcp-sse Command Injection via generate_payload

1) CNA / Submission Type

• Submission type: Report a vulnerability (CVE ID request)
• Reporter role: Independent security researcher
• Report date: April 13, 2026

2) Reporter Contact

• Reporter name: Winegee
• Reporter email: Winegee@zju.edu.cn
• Permission to share contact with vendor: Yes

3) Vendor / Product Identification

• Vendor: foolsec
• Product: mcp-sse
• Repository: https://github.com/foolsec/vibehacker_metasploit_mcp.git
• Reviewed local source path: python-batch-04/datasets/foolsec-vibehacker_metasploit_mcp
• Exposed interface: MCP tool generate_payload
• Affected component(s):
• main.py

4) Vulnerability Type

• CWE: CWE-78 (OS Command Injection)
• Short title: shell injection through the payload_type argument of generate_payload

5) Affected Versions

• Confirmed affected: 0.1.0
• Suspected affected range: revisions containing the same subprocess.run(cmd, shell=True, ...) implementation
• Fixed version: Not available at time of report (April 12, 2026)

6) Vulnerability Description

The MCP tool generate_payload is intended to call msfvenom with a user-selected payload type, listener host, listener port, and output format. Instead of invoking msfvenom with a fixed argv list, the implementation interpolates those fields into a shell string and executes it with shell=True.

Because payload_type, lhost, and format_type are all caller-controlled strings, shell metacharacters directly alter command structure. This enables arbitrary OS command execution on the host running the MCP server, not just malformed msfvenom invocations.

7) Technical Root Cause

1. MCP entry point
   • main.py:68-69
   • @mcp.tool() exposes generate_payload(payload_type, lhost, lport, format_type="raw").
2. Unsafe command construction
   • main.py:82
   • cmd = f"msfvenom -p {payload_type} LHOST={lhost} LPORT={lport} -f {format_type}"
3. Shell execution
   • main.py:84
   • subprocess.run(cmd, shell=True, check=True, capture_output=True, text=True)
4. Audit conclusion
   • Any caller that can invoke the tool can inject arbitrary shell commands through the exposed arguments.

8) Attack Prerequisites

• Ability to call the MCP tool generate_payload.
• No additional sandboxing that strips shell metacharacters before the tool is reached.

9) Proof of Concept / Reproduction Guidance

1. Reproduction request

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "generate_payload",
    "arguments": {
      "payload_type": "windows/meterpreter/reverse_tcp; touch /tmp/foolsec_poc #",
      "lhost": "127.0.0.1",
      "lport": 4444,
      "format_type": "raw"
    }
  }
}

2. Why this works

• The semicolon in payload_type terminates the intended msfvenom command.
• The shell then executes touch /tmp/foolsec_poc as a second command.
• The trailing # comments out the remaining LHOST=... LPORT=... -f raw text, preventing syntax issues.
• Because the last command in the shell sequence is touch, the overall shell exit status is still success and check=True does not stop exploitation.

3. Expected observable result

• /tmp/foolsec_poc is created on the server host.
• The tool may still report success because the last shell command (touch) exits successfully.

10) Security Impact

• Confidentiality: High, because arbitrary shell commands can read local data and exfiltrate credentials.
• Integrity: High, because arbitrary commands can modify files, install backdoors, or alter Metasploit state.
• Availability: High, because arbitrary commands can terminate processes or delete files.
• Scope: Changed.

11) CVSS v3.1 Suggestion

• Suggested vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Suggested base score: 10.0 (Critical) when the MCP tool is reachable by untrusted callers.

12) Workarounds / Mitigations

• Do not expose the server to untrusted MCP clients until the tool is rewritten.
• Disable generate_payload if it is not strictly required.
• Restrict access to trusted operators only.

13) Recommended Fix

• Replace shell-string execution with an argv list, for example ["msfvenom", "-p", payload_type, ...].
• Validate payload_type, format_type, and similar arguments against strict allowlists.
• Add tests proving metacharacters in these fields do not result in command execution.

14) References

• Repository: https://github.com/foolsec/vibehacker_metasploit_mcp.git
• Reviewed source file: main.py
• CWE-78: https://cwe.mitre.org/data/definitions/78.html

15) Credits

• Discoverer: Winegee
• Discovery method: Static analysis (CodeQL) plus local source-code audit

16) Additional Notes

• This PoC does not depend on a valid msfvenom payload type. The shell injection occurs before Metasploit argument validation matters.
• The repository exposes additional Metasploit control functionality, which increases the practical impact of host-level command execution.