Command Injection Vulnerability in MCP File Reader

@Eliran79

リポジトリ

基本情報

カテゴリ

開発者ツール

ライセンス

MIT license

トランスポート

stdio

作者

Eliran79

Command Injection Vulnerability in MCP File Reader について

A deliberately vulnerable MCP server demonstrating command injection flaws. This Python implementation shows how lack of input sanitization in file paths leads to critical security vulnerabilities allowing attackers to execute arbitrary commands. For educational purposes only - d

Command Injection Vulnerability in MCP File Reader の設定

標準の設定はありません

このサーバーの README には解析可能な MCP 設定ブロックが含まれていません。インストール手順はリポジトリをご確認ください。

リポジトリ

Command Injection Vulnerability in MCP File Reader のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Command Injection Vulnerability in MCP File Reader?

A deliberately vulnerable Python MCP server that demonstrates a critical command injection flaw in its read_file tool, intended for educational security testing.

How to use Command Injection Vulnerability in MCP File Reader?

Install Python 3.12+, MCP library 1.6.0, clone the repository, run mcp install main.py, configure Claude Desktop as shown in the README, then start with mcp dev main.py. Use the MCP Inspector to send malicious file_name values to the read_file tool.

Key features of Command Injection Vulnerability in MCP File Reader

Uses shell=True in subprocess calls
Interpolates user input directly into a shell command
Performs only superficial path validation
Demonstrates command injection payloads like ; whoami
Includes a proper fix using shlex.quote() or list arguments

Use cases of Command Injection Vulnerability in MCP File Reader

Security researchers learning about command injection in MCP servers
Educators demonstrating the dangers of shell=True with user input
Practicing exploitation techniques in a safe, local environment

よくある質問

What is the vulnerability in this server?

The `read_file` function runs `cat {file_name}` with `shell=True`, allowing an attacker to append arbitrary shell commands after a semicolon in the file name.

How can I fix the vulnerability?

Replace the unsafe call with a list argument (`subprocess.check_output(['cat', file_name])`) or use `shlex.quote(file_name)` if `shell=True` is necessary. Also validate that the resolved path stays within the allowed directory.

What dependencies are required?

Python 3.12 or higher and the MCP library version 1.6.0.

Can this server be used in production?

No, this implementation is for educational purposes only and must never be used on production systems or with sensitive data.

How do I connect to the server from an MCP client?

Configure Claude Desktop by editing `~/.config/claude-desktop/claude_desktop_config.json` with the appropriate command and arguments as shown in the README.

「開発者ツール」の他のコンテンツ

Cronwatch

cronwatchdev

CronWatch records every run of your scheduled jobs in your own database, and speaks up when one is missed, fails, gets stuck, runs slow or costs too much. CronWatch is free and open-source.

ArtiBot Cloud MCP - Zhijiangyun 智匠云

bofob

ArtiBot Cloud MCP (Zhijiangyun 智匠云) — cloud MCP server for robot manipulation data & GPU workloads. 15 tools: robot fleet management, data collection & video recording, post-processing pipelines, and benchmark evaluation

Official Porkbun MCP Server

Porkbun LLC

Official Porkbun MCP server, maintained by Porkbun. Check domain availability and pricing, register, renew and transfer domains, and manage DNS records, nameservers, URL forwarding, glue records, DNSSEC and domain contac

Moxie Docs

Jackalope-Dev

Automated codebase documentation for GitHub: searchable docs, MCP context for AI agents, doc drift detection, and Friday Cleanup PRs.

Just Domain.

Just.

Just Domain is the domain registrar for businesses built with AI. An AI assistant checks availability and both prices, first year and renewal, and hands back a checkout link for justdomain.ai. Read only by design: no pur