Description

This vulnerability exists because MCPJam Inspector exposes internal API endpoints intended for debugging and development. These endpoints accept user-controlled input and pass it directly to system-level process execution without proper validation or sanitization. By sending a crafted request to the vulnerable endpoint (/api/mcp/connect), an attacker can control the serverConfig object and specify arbitrary commands to be executed on the host. The application attempts to spawn a process based on user input and treat it as a valid MCP server. However, due to the lack of input validation, this behavior can be abused to execute arbitrary system commands.

How it works

The exploit abuses the following logic:

1. The backend accepts a JSON payload containing:

• command
• args These values are used to spawn a process on the server

2. No validation is performed on these fields
3. The process is executed even if it is not a valid MCP server

Since the application expects a long-running MCP process, short-lived commands may cause connection errors — but the command is still executed.

Usage

python3 exploit.py '' Example: python3 exploit.py domain.com "sleep 4"

Notes