Listen to this Post
How the mentioned CVE works:
Cherry Studio versions 1.2.5 through 1.5.1 integrate with MCP (Model Context Protocol) servers for enhanced LLM functionalities. In HTTP Streamable mode, the client establishes a connection to an MCP server to handle OAuth authorization flows. During this process, the client reads data from the server’s HTTP streams and incorporates it into system-level commands without proper input sanitization. A malicious MCP server can be configured with crafted OAuth authorization endpoints that output payloads containing shell metacharacters or direct commands. When a victim is tricked into connecting Cherry Studio to this server, the client processes the malicious streamed data. The unsanitized input is then passed directly to the OS command interpreter, allowing arbitrary command execution. This injection occurs during the OAuth token exchange or similar authentication steps, where user-controlled server responses are trusted. The attack requires initial user interaction to connect to the malicious server, often via social engineering. Once connected, the exploitation is automatic and can lead to full compromise of the client’s host system. The vulnerability stems from insecure handling of external data in the HTTP streaming pipeline, bypassing standard security checks.
Platform: Cherry Studio
Version: 1.2.5 to 1.5.1
Vulnerability: OS Command Injection
Severity: Critical
Date: 08/13/2025
Prediction: Patched in 1.5.2
What Undercode Say:
Analytics:
Check installed version
cat /Applications/Cherry\ Studio.app/Contents/Info.plist | grep -A1 CFBundleShortVersionString
Simulate malicious server response with injection
python3 -c “import http.server; server = http.server.HTTPServer((”,8080), lambda r,h: (h.send_response(200), h.end_headers(), h.wfile.write(b’&& cat /etc/passwd’)))”
Test client connection to local server
curl -v http://localhost:8080/oauth/token
How Exploit:
Setup malicious MCP server with HTTP Streamable mode and crafted OAuth endpoints injecting commands like ; rm -rf / or reverse shells. Trick user into connecting via malicious configuration file or link.
Protection from this CVE:
Update to version 1.5.2. Validate and sanitize all server inputs. Use allowlists for MCP servers.
Impact:
Remote code execution, system takeover, data leakage, privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
