Summary
The MCP server foundry-mcp-server is vulnerable to command injection due to unsafe use of child_process.execAsync with user-controlled input in the cast_call, cast_send, cast_balance,cast_receipt, cast_chain, anvil_start, forge_script, convert_eth_units, heimdall_disassemble, heimdall_decode, heimdall_decompile, heimdall_cfg, and heimdall_inspect tools.
Affected Versions
<= 0.1.5
Vulnerable Code
https://github.com/PraneshASP/foundry-mcp-server/blob/main/src/tools/cast/call.ts#L10-L17
https://github.com/PraneshASP/foundry-mcp-server/blob/main/src/tools/cast/call.ts#L28-L46
https://github.com/PraneshASP/foundry-mcp-server/blob/main/src/utils/command.ts#L55-L57
Details
The MCP server foundry-mcp-server constructs command strings using user-supplied parameters and executes them via child_process.execAsync in multiple tools. Because execAsync invokes commands through a system shell, specially crafted input containing shell metacharacters (such as ;, &, or |) may be interpreted as additional commands rather than treated as data.
For example, an attacker could supply a malicious value in functionSignature to inject arbitrary shell commands, which would then be executed with the privileges of the MCP server process.
The vulnerability results from shell-based command execution combined with direct interpolation of untrusted input. In MCP environments, LLM-generated tool parameters influenced by external content may trigger execution of injected commands without direct local user interaction.
Impact
Successful exploitation allows attackers to execute arbitrary commands on the server hosting the MCP service. This may allow attackers to execute commands, access sensitive data, or modify the host environment depending on the privileges of the MCP server.
Recommendation
Don't use exec. Use execFile instead, which pins the command and provides the arguments as array elements.
Apply strict input validation to all tool parameters exposed to MCP clients, especially parameters mentioned above.
Use parameter separation with proper escaping to prevent shell command injection.
PoC
See the attached files:
foundry-mcp-server_bug.pdf
Credit
Discovered and reported by Yinci Chen.
Summary
The MCP server foundry-mcp-server is vulnerable to command injection due to unsafe use of child_process.execAsync with user-controlled input in the cast_call, cast_send, cast_balance,cast_receipt, cast_chain, anvil_start, forge_script, convert_eth_units, heimdall_disassemble, heimdall_decode, heimdall_decompile, heimdall_cfg, and heimdall_inspect tools.
Affected Versions
<= 0.1.5
Vulnerable Code
https://github.com/PraneshASP/foundry-mcp-server/blob/main/src/tools/cast/call.ts#L10-L17
https://github.com/PraneshASP/foundry-mcp-server/blob/main/src/tools/cast/call.ts#L28-L46
https://github.com/PraneshASP/foundry-mcp-server/blob/main/src/utils/command.ts#L55-L57
Details
The MCP server foundry-mcp-server constructs command strings using user-supplied parameters and executes them via child_process.execAsync in multiple tools. Because execAsync invokes commands through a system shell, specially crafted input containing shell metacharacters (such as ;, &, or |) may be interpreted as additional commands rather than treated as data.
For example, an attacker could supply a malicious value in functionSignature to inject arbitrary shell commands, which would then be executed with the privileges of the MCP server process.
The vulnerability results from shell-based command execution combined with direct interpolation of untrusted input. In MCP environments, LLM-generated tool parameters influenced by external content may trigger execution of injected commands without direct local user interaction.
Impact
Successful exploitation allows attackers to execute arbitrary commands on the server hosting the MCP service. This may allow attackers to execute commands, access sensitive data, or modify the host environment depending on the privileges of the MCP server.
Recommendation
Don't use exec. Use execFile instead, which pins the command and provides the arguments as array elements.
Apply strict input validation to all tool parameters exposed to MCP clients, especially parameters mentioned above.
Use parameter separation with proper escaping to prevent shell command injection.
PoC
See the attached files:
foundry-mcp-server_bug.pdf
Credit
Discovered and reported by Yinci Chen.