Remote Code Execution in MCP Inspector

This repository is a deliberately vulnerable Node.js/Express + WebSocket CTF lab that demonstrates a real session isolation failure pattern mapped to CVE-2025-49596. The core flaw is in mcp/session.js: a single module-level sharedSessionContext is initialized once with admin credentials by initAdminSession(), then getUserContext() mutates only currentUser and permissions for user requests while leaving oauthToken and sessionId untouched. As a result, user-scoped operations inherit stale admin state. Repository structure: server.js is the main entry point and HTTP/WebSocket server; mcp/session.js contains the vulnerable shared context logic; mcp/tools.js defines three MCP tools (session_info, token_inspect, file_read) and the timing-window logic; mcp/server.js implements a subset of MCP JSON-RPC and the WebSocket broadcaster; public/app.js is the browser client that invokes tools, connects to the WebSocket stream, and stores debugTrace in sessionStorage; flags/validator.js validates CTF flags using SHA-256 hashes. README.md and SPOILERS.md document the intended challenge and explicitly describe the vulnerability and walkthrough. Main exploit capabilities: (1) every POST to /mcp/tools/call sets X-Session-Token to ctx.oauthToken, which remains the admin token; (2) session_info returns ctx.sessionId, leaking the admin session ID; (3) the WebSocket endpoint /mcp/stream sends an initial user-looking session_event followed 1.5 seconds later by a second frame sourced from getRawContext(), leaking the admin session ID; (4) token_inspect called 2-5 seconds after session_info on the same X-Conn-Id triggers a debugTrace and timing_ref leak, and the browser stores debugTrace in sessionStorage['mcp_debug_trace']; (5) file_read is not a true arbitrary file read primitive here, but a simulated MCP tool returning fixed content for a supplied path. This is a valid exploit/lab rather than a detector. It is operational because the vulnerable server is fully runnable and the leakage primitives are implemented end-to-end, though the payload is fixed and educational rather than broadly weaponized.

This repository is a small, single-purpose proof-of-concept exploit for CVE-2025-49596 affecting MCPJam Inspector prior to 1.4.2 on Linux. The repository contains only two files: a Python exploit script (CVE-2025-49596.py) and a short README with usage instructions. The Python script is the main entry point and uses the requests library to send crafted POST requests to the target's /api/mcp/connect endpoint with JSON data that appears to instruct the remote service to execute arbitrary commands. Exploit flow: the script accepts three command-line arguments: target base URL, attacker host, and attacker port. It builds a bash reverse-shell payload, writes it to a local file named 'shell', and starts a temporary Python HTTP server on port 8989 to host that file. It then sends a POST request to the target instructing it to run curl and download the payload from the attacker-controlled server into /tmp/shell2. After the download, the local HTTP server is terminated. The script then sends additional POST requests to chmod +x /tmp/shell2 and finally execute it using sh -c /tmp/shell2. If successful, the target connects back to the attacker listener using /dev/tcp/<lhost>/<lport>. The exploit is clearly offensive and not merely a detector. It provides practical RCE with a hardcoded reverse-shell delivery chain, making it more than a basic PoC but not highly modular. Notable implementation details include disabled TLS certificate verification and suppression of urllib3 insecure-request warnings. The code assumes the target can reach the attacker over the network, has curl available, can write to /tmp, and is running in a Linux environment with bash/sh support.