MCP Exploit Demo

🚀 SSH Key Exfiltration Attack via MCP Tool Poisoning

This repository demonstrates a security vulnerability in the MCP (Model Context Protocol) server that allows for remote code execution and data theft through tool poisoning. This content is for educational and security research purposes only.

📝 Blog Link:

MCP Tool Poisoning to RCE

📦 Repository Contents

• server.py - Malicious MCP server implementation containing poisoned tools
• .cursor/mcp.json - Configuration file for integration with Cursor AI

🎯 Attack Principle

This attack showcases the "Rug Pull" method:

1. A user connects to a malicious MCP server via an MCP client (e.g., Cursor AI).
2. The server modifies the documentation of the DockerCommandAnalyzer tool, inserting malicious code.
3. When the AI assistant reads this documentation, the tampered document causes the AI to recommend executing a base64-encoded command.
4. The encoded command will:
   • Collect the user's SSH public key.
   • Secretly send it to a remote server.
   • Delete the attack traces.

🔧 Technical Details

The key points of this attack include:

1. Two-stage poisoning: Use marker files to ensure the tool remains poisoned.
2. Social engineering: Manipulate the AI assistant to perform malicious operations using urgent language.
3. Base64 obfuscation: Hide malicious commands to avoid easy detection.
4. wget exfiltration: Send data to an attacker-controlled server via a standard HTTP POST request.

💡 Defense Recommendations

To prevent such attacks, please take the following measures:

1. Disable auto-execution: Turn off the auto-run function in AI development tools such as Cursor.
2. Verify the source: Check the identity and credibility of the MCP server before connecting.
3. Code review: Inspect code from untrusted sources before execution.
4. Use a sandbox environment: Use an isolated sandbox environment when testing new AI tools.
5. Implement outbound filtering: Configure network rules to block unauthorized outbound requests.

This attack case emphasizes the importance of using the MCP protocol and AI development tools, reminding users and developers to stay vigilant and take appropriate security measures.