From 905076ac161c4df68eff5ad9b0e0388132b5f60e Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Sat, 1 Aug 2026 19:13:20 +0000 Subject: [PATCH] Add content from: HTB Kobold: MCPJam RCE, PrivateBin LFI-to-RCE, and Docker Ho... --- src/AI/AI-MCP-Servers.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/src/AI/AI-MCP-Servers.md b/src/AI/AI-MCP-Servers.md index 3123fe1d1e3..ce0c38f410f 100644 --- a/src/AI/AI-MCP-Servers.md +++ b/src/AI/AI-MCP-Servers.md @@ -212,6 +212,36 @@ When testing MCP development environments, look for: - OAuth / redirect flows that render attacker-controlled URLs inside the local UI. - Proxy endpoints that accept arbitrary `command`, `args`, or server configuration JSON. +### Remote Process-Launch APIs Exposed Beyond Loopback + +Some MCP inspector/dev panels do not just proxy JSON-RPC traffic; they also expose helper endpoints that **spawn local MCP servers** from client-supplied configuration. If that HTTP API is reachable from `0.0.0.0`, reverse-proxied on a public vhost, or left unauthenticated on an internal segment, it becomes remote OS command execution. + +A common request shape is a `serverConfig`/`server_params` object containing `command`, `args`, and `env`, for example: + +```json +{ + "serverConfig": { + "command": "bash", + "args": ["-c", "id"], + "env": {} + }, + "serverId": "test" +} +``` + +Practical notes: + +- Endpoints named like `/api/mcp/connect`, `/servers/connect`, `/spawn`, or `/start` are higher risk than plain `tools/list` because they create a new local subprocess. +- A response such as `Connection closed`, `protocol error`, or `handshake failed` may still mean **code execution already happened**: the child process ran, but it did not speak MCP after launch. Verify first with ICMP, DNS, or HTTP callbacks before moving to a shell. +- Treat client-controlled `env`, working-directory, plugin-path, or package-install parameters as equivalent to raw `command`/`args`. +- During audits, confirm whether the API is loopback-only, whether the reverse proxy forwards it externally, and whether authentication is enforced **before** the spawn path. + +Defensive priorities: + +- Bind inspector/dev APIs to `127.0.0.1` or a dedicated admin network. +- Require authentication and authorization on the spawn endpoint itself. +- Store launch definitions server-side and allowlist approved binaries; never forward raw `command` / `args` / `env` into `spawn`, `exec`, or `subprocess` calls. + ### Agent-Assisted Localhost MCP Hijacking (AutoJack pattern) If an **AI browsing agent** runs on the same workstation as a privileged local MCP control plane, **localhost is not a trust boundary**. A malicious page rendered by the agent can reach `ws://127.0.0.1` / `ws://localhost`, abuse weak WebSocket trust assumptions, and turn the agent into a **confused deputy** that drives the local control plane. @@ -490,5 +520,7 @@ Another suspicious primitive is **native-code preloading**. A skill that sets `L - [otto-support `selfpwn` source](https://github.com/BishopFox/otto-support/blob/main/cmd/otto-support/selfpwn.go) - [Model Context Protocol Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) - [MCP Inspector proxy server lacks authentication between the Inspector client and proxy](https://github.com/advisories/GHSA-7f8r-222p-6f5g) +- [REC in MCPJam inspector due to HTTP Endpoint exposes](https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6) +- [HTB Kobold: MCPJam RCE, PrivateBin LFI-to-RCE, and Docker Host Takeover](https://0xdf.gitlab.io/2026/08/01/htb-kobold.html) {{#include ../banners/hacktricks-training.md}}