mcp-shell Allowlist Bypass Leading to Arbitrary Command Execution

Technical Analysis

The security.yaml default configuration allows '/bin/bash' as an executable, and security.go's validation logic only inspects the first token of the supplied command string rather than fully parsing arguments. checkBlockedPatternsAndCommands additionally fails to blocklist the '-c' flag, which instructs bash to execute an arbitrary string as a command. Because parseCommand and exec.CommandContext in executor.go then execute the full argument list, any MCP client or agent capable of calling the shell_exec tool can smuggle a payload as '/bin/bash -c "<arbitrary-command>"', passing the allowlist check while running unrestricted commands under the mcpuser account. This crosses the tool boundary between the LLM/agent (which only needs to construct a plausible-looking, allowlisted-appearing shell_exec call) and the underlying host OS, effectively turning a policy-scoped exec tool into unrestricted remote command execution reachable via any upstream prompt injection or agent compromise that can influence tool-call arguments.

Affected Systems

mcp-shell; protocols: MCP

Detection Signatures

• shell_exec tool calls with command arguments containing '/bin/bash -c' or 'bash -c'
• security.yaml allowed_executables entries containing generic shell interpreters (/bin/bash, /bin/sh, /bin/zsh)
• Command validation logic that only checks argv[0] and ignores subsequent flags/arguments
• MCP server logs showing shell_exec invocations with embedded command strings after '-c'
• Execution of unexpected child processes spawned from mcpuser context via mcp-shell

Remediation Steps

1. 1

   Upgrade mcp-shell

   Update to mcp-shell 0.6.0 or later, which fixes the validation logic to reject shell command-mode flags.

2. 2

   Harden allowlists

   Remove generic shell interpreters (bash, sh, zsh) from allowed_executables unless strictly required; prefer explicit fixed-argument commands.

3. 3

   Full argument validation

   Ensure any command execution wrapper validates the entire argument vector, not just the first token, and explicitly blocks command-mode flags like -c, --command, -eval, etc.

4. 4

   Least privilege execution

   Run the MCP shell server under a tightly scoped, non-privileged account with minimal filesystem and network access, and apply seccomp/AppArmor profiles or container isolation.

5. 5

   Audit and monitor

   Log and alert on all shell_exec tool invocations, especially those containing shell metacharacters, command-mode flags, or unexpected nested commands.