Security: MCP server config enables arbitrary command execution #75

New issue

Open

opened 2026-05-11 13:48:49 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 13:48:49 +00:00

Owner

Severity: Critical

Location

crates/hero_aibroker_lib/src/mcp.rs — McpServerConfig with command and args

Finding

MCP servers are spawned as arbitrary child processes from YAML config:

pub struct McpServerConfig {
    pub name: String,
    pub command: String,
    pub args: Vec<String>,
    pub env: Option<HashMap<String, String>>,
}

let mut child = Command::new(&config.command)
    .args(&config.args)
    .stdin(Stdio::piped())
    .stdout(Stdio::piped())
    .stderr(Stdio::piped())
    .spawn()?;

Attack Scenario

If YAML config is user-modifiable, arbitrary commands execute as the broker user
No sandboxing, seccomp, or capability restrictions
Child processes inherit all broker environment variables (potentially including API keys)
No resource limits (memory, CPU, network) on spawned processes

Recommendation

Whitelist allowed commands/paths
Add optional seccomp/AppArmor profiles
Drop unnecessary capabilities before spawn
Resource limits via cgroups or rlimit
Validate config against a schema before execution

## Severity: Critical ## Location `crates/hero_aibroker_lib/src/mcp.rs` — `McpServerConfig` with `command` and `args` ## Finding MCP servers are spawned as arbitrary child processes from YAML config: ```rust pub struct McpServerConfig { pub name: String, pub command: String, pub args: Vec<String>, pub env: Option<HashMap<String, String>>, } ``` ```rust let mut child = Command::new(&config.command) .args(&config.args) .stdin(Stdio::piped()) .stdout(Stdio::piped()) .stderr(Stdio::piped()) .spawn()?; ``` ## Attack Scenario - If YAML config is user-modifiable, arbitrary commands execute as the broker user - No sandboxing, seccomp, or capability restrictions - Child processes inherit all broker environment variables (potentially including API keys) - No resource limits (memory, CPU, network) on spawned processes ## Recommendation - Whitelist allowed commands/paths - Add optional seccomp/AppArmor profiles - Drop unnecessary capabilities before spawn - Resource limits via cgroups or `rlimit` - Validate config against a schema before execution