mcp-exploit-demo
If you are the rightful owner of mcp-exploit-demo and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
This repository demonstrates a security vulnerability in MCP servers that allows for remote code execution and data exfiltration through tool poisoning.
The repository showcases a security vulnerability in Model Context Protocol (MCP) servers, specifically focusing on remote code execution and data exfiltration through tool poisoning. The attack, known as the 'Rug Pull' method, involves a user connecting to a malicious MCP server, which then modifies a tool's documentation with malicious code. This code, when executed by an AI assistant, collects and exfiltrates the user's SSH public keys to a remote server. The attack uses techniques such as two-stage poisoning for persistence, social engineering to manipulate AI assistants, base64 obfuscation to hide malicious commands, and wget for data exfiltration. Mitigation strategies include disabling auto-run features, verifying MCP server sources, reviewing code from untrusted sources, using sandboxed environments, and implementing egress filtering.
Features
- Two-stage poisoning for persistence
- Social engineering to manipulate AI assistants
- Base64 obfuscation of malicious commands
- Data exfiltration using wget
- Mitigation strategies for protection
