GHSA-wvxp-jp4w-w8wg: mcp-server-kubernetes has potential security issue in exec_in_pod tool
SummaryA security issue exists in the `exec_in_pod` tool of the `mcp-server-kubernetes` MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (`sh -c`) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent.DetailsThe MCP Server exposes the `exec_in_pod` tool to execute commands inside Kubernetes pods. The tool supports both array and string command formats. The Kubernetes Exec API (via `@kubernetes/client-node`) accepts commands as an array of strings, which executes commands directly without shell interpretation. However, when a string format is provided, the code automatically wraps it in shell execution (`sh -c`), which interprets shell metacharacters without any input validation.When string commands contain shell metacharacters (e.g., `;`, `&&`, `|`, `>`, `<`, `$`), they are interpreted by the shell rather than being passed as literal arguments, allowing command injection. This vulnerability can be exploited in two ways:**Direct command injection**: Users or attackers with access to the MCP server can directly inject malicious commands through the tool interface.**Indirect prompt injection**: Malicious instructions embedded in data (e.g., pod logs) can trick AI agents into executing commands without explicit user intent.Code patternThe following snippet illustrates the code pattern used in the `exec_in_pod` tool:**File**: `src/tools/exec_in_pod.ts`When `input.command` is a string, the code automatically wraps it in a shell command (`/bin/sh -c`), which interprets shell metacharacters. There is no input validation to detect or block shell metacharacters, allowing arbitrary command execution through command chaining (e.g., `id>/tmp/TEST && echo done`).PoCDirect command injection via MCP InspectorThis demonstrates command injection through direct tool invocation:**Start a Kubernetes cluster** (e.g., using minikube):**Create a test pod:****Open the MCP Inspector:****In MCP Inspector:**Set transport type: `STDIO`Set the `command` to `npx`Set the arguments to `-y mcp-server-kubernetes --stdio`Click **Connect**Go to the **Tools** tab and click **List Tools**Select the `exec_in_pod` tool**Verify the file `/tmp/TEST` does NOT exist before execution:****In MCP Inspector, fill in the fields:****Name field**: `test-pod`**Namespace field**: `default`**Command field**: `"id>/tmp/TEST && echo done"` (include quotes)Click **Run Tool****Observe the request being sent:****Verify the file `/tmp/TEST` exists after execution (confirming command injection):**The file `/tmp/TEST` was created, confirming that the injected command (`id>/tmp/TEST`) executed successfully, even though the intended command was only `id`.Indirect prompt injection via pod logsAn MCP Client can be instructed to execute additional actions via indirect prompt injection in pod logs. When the client reads pod logs as part of its contextual input, it may interpret injected instructions embedded in log messages as legitimate commands or follow-up instructions.**Create a pod that contains instructions in logs:**Create `poc-indirect-injection.yaml`:**Apply the pod:****Verify the file `/tmp/TEST1` does NOT exist before execution:****Use an MCP Client IDE:**Add and enable the `mcp-server-kubernetes`:**Important**: The `KUBECONFIG` environment variable must be explicitly set in the `env` section because `mcp-server-kubernetes` needs to connect to the Kubernetes API server (which requires authentication credentials stored in the kubeconfig file). The MCP server process may not inherit the user's shell environment variables. Replace `/path/to/.kube/config` with your actual kubeconfig path.**Open the chat and use the following prompt:****The MCP client will:**Call `kubectl_logs` tool to read the pod logsThe AI will read the logs and interpret the injected instructionsThe AI may automatically call `exec_in_pod` tool:**Verify the file `/tmp/TEST1` exists after execution (confirming indirect prompt injection):**The file `/tmp/TEST1` was created, confirming that the AI agent executed the command from the injected instructions in the pod logs, demonstrating indirect prompt injection.ImpactCommand injection allows arbitrary command execution within Kubernetes pods through shell metacharacter interpretation.**Command Injection**: Shell metacharacters in string commands are interpreted, allowing command chaining and arbitrary command execution**Data Access**: Commands can access sensitive data within pods (secrets, configmaps, environment variables)**Pod State Modification**: Commands can modify pod state or install backdoors**Indirect Prompt Injection**: When combined with indirect prompt injection, AI agents may execute commands without explicit user intent
CVSS v3.1: 6.4