mcp-shell Git Alias Command Injection via shell_exec Tool

Technical Analysis

The mcp-shell server exposes a shell_exec MCP tool intended to run allow-listed executables like /usr/bin/git safely. Its security filters (containsShellMetacharacters and containsDangerousShellConstructs) fail to block the '!' character, and no per-executable argument policy is enforced, so an attacker can pass '/usr/bin/git -c alias.pwn=!<arbitrary-command>' as the command argument. Git's alias mechanism interprets the '!' prefix as a shell escape, causing Git to execute the attacker-supplied command through the shell rather than as a Git subcommand, bypassing the entire security allow-list. Because this occurs inside the MCP tool invocation path, an LLM agent that is tricked (via prompt injection, a malicious upstream tool response, or a compromised user request) into calling shell_exec with this payload becomes an unwitting vector for full OS command execution as the mcpuser account. The flaw crosses the agent-to-tool trust boundary: the MCP client/agent has no way to know the 'secure' shell tool is not actually enforcing its allow-list, enabling privilege escalation and lateral movement from the agent runtime into the underlying host or container.

Affected Systems

mcp-shell; protocols: MCP

Detection Signatures

• Tool call arguments to shell_exec containing 'git' combined with '-c alias.' and '!'
• Command strings matching pattern: -c alias.<name>=!
• Git invocations spawning unexpected child shell processes
• Unusual outbound network or file activity originating from mcpuser process shortly after a git-related MCP tool call
• MCP audit logs showing shell_exec commands with embedded '=!' sequences
• security.yaml allow-lists including /usr/bin/git without argument restrictions

Remediation Steps

1. 1

   Upgrade mcp-shell

   Update to mcp-shell version 0.6.0 or later, which fixes the filter bypass and adds '!' detection plus per-executable argument policies.

2. 2

   Restrict default allow-list

   Remove or tightly scope /usr/bin/git from security.yaml unless argument-level policies (e.g., disallowing '-c alias.*=!') are enforced.

3. 3

   Enforce per-executable argument policy

   Implement allow-lists that validate specific subcommands and arguments per executable rather than relying solely on generic shell-metacharacter blacklisting.

4. 4

   Run with least privilege

   Run the mcp-shell container/process as a non-privileged, tightly sandboxed user with no access to sensitive host resources, and avoid installing unnecessary tools like git in the image.

5. 5

   Audit and monitor MCP tool calls

   Log and alert on shell_exec invocations containing suspicious patterns such as 'alias' and '!' to detect exploitation attempts in real time.

6. 6

   Validate agent-supplied tool arguments

   Add an additional validation layer between the AI agent's tool-call output and the MCP server execution path to catch known bypass patterns before execution.