Command Injection Vulnerability in MCP File Reader

@Eliran79

代码仓库

基本信息

分类

开发工具

许可证

MIT license

传输方式

stdio

作者

Eliran79

关于 Command Injection Vulnerability in MCP File Reader

A deliberately vulnerable MCP server demonstrating command injection flaws. This Python implementation shows how lack of input sanitization in file paths leads to critical security vulnerabilities allowing attackers to execute arbitrary commands. For educational purposes only - d

Command Injection Vulnerability in MCP File Reader 配置

暂无标准配置

该服务器的 README 中没有可解析的 MCP 配置块，请前往代码仓库查看安装说明。

代码仓库

Command Injection Vulnerability in MCP File Reader 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Command Injection Vulnerability in MCP File Reader?

A deliberately vulnerable Python MCP server that demonstrates a critical command injection flaw in its read_file tool, intended for educational security testing.

How to use Command Injection Vulnerability in MCP File Reader?

Install Python 3.12+, MCP library 1.6.0, clone the repository, run mcp install main.py, configure Claude Desktop as shown in the README, then start with mcp dev main.py. Use the MCP Inspector to send malicious file_name values to the read_file tool.

Key features of Command Injection Vulnerability in MCP File Reader

Uses shell=True in subprocess calls
Interpolates user input directly into a shell command
Performs only superficial path validation
Demonstrates command injection payloads like ; whoami
Includes a proper fix using shlex.quote() or list arguments

Use cases of Command Injection Vulnerability in MCP File Reader

Security researchers learning about command injection in MCP servers
Educators demonstrating the dangers of shell=True with user input
Practicing exploitation techniques in a safe, local environment

常见问题

What is the vulnerability in this server?

The `read_file` function runs `cat {file_name}` with `shell=True`, allowing an attacker to append arbitrary shell commands after a semicolon in the file name.

How can I fix the vulnerability?

Replace the unsafe call with a list argument (`subprocess.check_output(['cat', file_name])`) or use `shlex.quote(file_name)` if `shell=True` is necessary. Also validate that the resolved path stays within the allowed directory.

What dependencies are required?

Python 3.12 or higher and the MCP library version 1.6.0.

Can this server be used in production?

No, this implementation is for educational purposes only and must never be used on production systems or with sensitive data.

How do I connect to the server from an MCP client?

Configure Claude Desktop by editing `~/.config/claude-desktop/claude_desktop_config.json` with the appropriate command and arguments as shown in the README.

开发工具分类下的更多 MCP 服务器

Termany

thinkany-ai

Agent-Native Terminal

174

Vibgrate MCP

Vibgrate

Query your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up

Eased

easedui

Eased is a library of motion-first React components for shadcn, installed with the shadcn CLI.

TranscriptFetch MCP Server

TranscriptFetch

Model Context Protocol (MCP) server for TranscriptFetch: fetch YouTube transcripts, search, channels, and playlists from any MCP client.

Mcp-Warden

ermoluk

Local-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.