MCP OAuth Authorization URL — Command Injection via URL Authority
An attacker hides a shell command inside the username portion of an OAuth authorization URL used in the Model Context Protocol (MCP) flow. If the client software passes that part of the URL to a shell without sanitizing it, the hidden command runs on the machine handling the OAuth request.
How the attack works
The attacker crafts a URL like http://user$(mate-calc)r:pass@host/authorize?... where the userinfo section (before the @) contains shell metacharacters such as $(), backticks, or pipes. A vulnerable OAuth client parses this URL as part of the MCP authorization flow and forwards the userinfo string to a shell command without stripping the metacharacters. The shell then executes the embedded command as if it were part of a legitimate operation. This gives the attacker code execution on whatever system handles that OAuth redirect.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7174569a-5fdc-4de9-bf77-10e505277be4
- Severity
- Critical
Why it matters
An organization running a vulnerable MCP OAuth client can suffer arbitrary command execution on the host processing the authorization URL, which can lead to full compromise of that system and anything it has access to.
What you can do
- →Never pass URL userinfo (or any URL component) directly to a shell command or subprocess call; use parameterized APIs instead.
- →Validate and reject OAuth authorization URLs containing shell metacharacters ($, `, |, ;, &) in the userinfo or any field before further processing.
- →Strip or ignore the userinfo component of OAuth URLs entirely if it is not required for authentication.
- →Review MCP client code paths that handle authorization/redirect URLs for any shell invocation or string interpolation into system calls.
Known benign look-alikes
- Security scanners that test OAuth endpoints with shell-metacharacter payloads and log the test URLs — these appear in scanner output files, not in production OAuth flows
- URL encoding edge cases where a percent-encoded dollar sign or backtick appears in a legitimate OAuth token — the pattern requires literal unencoded metacharacters