Listen to this Post
Cherry Studio version 1.5.1 has a remote code execution vulnerability in its streamableHttp MCP server handling. The issue occurs during OAuth authentication redirection. The server implicitly trusts the redirection endpoints provided by MCP servers. It fails to sanitize or validate these URL parameters before processing. An attacker can craft a malicious MCP server with a manipulated OAuth callback URL. This URL contains embedded malicious code, such as JavaScript or system commands. When Cherry Studio connects to this server, it initiates the OAuth flow. The server responds with a redirection to the malicious URL. Due to lack of sanitization, Cherry Studio processes this URL without escaping. This triggers the execution of the embedded code on the user’s system. The vulnerability allows arbitrary command execution with the privileges of the Cherry Studio process. Attackers can exploit this to gain full control over the affected desktop client. The exploitation is remote and may require user interaction to connect to the malicious server. The flaw is critical as it compromises the entire host. Patched in version 1.5.2 by adding proper URL validation and sanitization routines.
Platform: Cherry Studio
Version: 1.5.1
Vulnerability: Remote Code Execution
Severity: Critical
Date: 08/13/2025
Prediction: Patched in 1.5.2
What Undercode Say:
Analytics:
Bash commands:
– `curl -v “http://target/mcp/streamableHttp?url=javascript:eval(‘payload’)”`
– `nmap -sV –script http-oauth-redirect target-ip`
Codes:
malicious_url = "http://oauth-callback?code=<?php exec('id'); ?>"
requests.get(malicious_url)
How Exploit:
Craft malicious MCP server.
Embed code in OAuth redirect.
Trick user into connecting.
Execute payload remotely.
Protection from this CVE:
Update to version 1.5.2.
Sanitize all URL inputs.
Restrict MCP server connections.
Impact:
Full system compromise.
Credentials theft potential.
Arbitrary command execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
