Listen to this Post
The vulnerability exists within the experimental MCP server feature (serverless mcp). The `list-projects` tool accepts a user-controlled `workspaceRoots` parameter. This input is passed without sanitization to the `findServerlessFrameworkProjects` function. This function uses `execAsync` (a wrapper for child_process.exec) to run a shell command searching for `serverless.yml` files. The user input is directly interpolated into the shell command string: find "${rootDir}" -name "serverless.yml".... Because `child_process.exec` spawns a shell, an attacker can provide a `workspaceRoots` value like "$(malicious_command)". The shell interprets the `$()` substitution, executing the injected command with the privileges of the server process, leading to Remote Code Execution (RCE).
Platform: Serverless Framework MCP
Version: (pre-fix versions)
Vulnerability: Command Injection -> RCE
Severity: Critical
date: 2025
Prediction: 2025-10-15
What Undercode Say:
serverless mcp --transport sse
cat /tmp/TEST
const { stdout } = await execAsync(<code>find "${rootDir}" -name "serverless.yml"...</code>);
How Exploit:
curl -X POST ... --data '{"workspaceRoots":["$(id>/tmp/exploit)"]}'
Protection from this CVE:
Use `execFile` not `exec`.
Implement input sanitization.
Disable experimental MCP server.
Impact:
Remote Code Execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
