High

MCP StreamableHttp OAuth Redirect URL Command Injection

Some AI agent clients that speak the MCP protocol will fetch an OAuth authorization URL from a remote MCP server and then hand that URL, unsanitized, to a spawned shell command. If the server returns a malicious URL containing shell metacharacters, it can run arbitrary commands on the machine hosting the agent. This affects Cherry Studio versions 1.5.1 and earlier.

How the attack works

The agent (or an MCP client helper it spawns) connects to a streamableHttp MCP server and requests an OAuth authorization/redirect endpoint. The malicious server replies with a URL that contains shell injection syntax, such as backticks, $(), a percent-encoded newline, or an eval/IEX call, disguised as part of the redirect. The client then passes this URL straight into a new process's command line without sanitizing it, so the injected characters get interpreted by the shell and execute attacker-controlled commands. Optionally, the resulting rogue process reaches back out to a remote host, confirming a second-stage payload download.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
7f3c1e94-2b6a-4d58-9c07-e1a5d84b6f21
Severity
High

Why it matters

An attacker running a rogue or compromised MCP server can achieve remote code execution on the machine running the vulnerable MCP client, using nothing more than a crafted OAuth redirect response.

What you can do

  • →Upgrade or patch any MCP client (such as Cherry Studio) that passes OAuth redirect URLs to spawned processes without sanitizing them.
  • →Restrict which MCP servers your agents are allowed to connect to, and treat OAuth/redirect URLs from untrusted servers as untrusted input.
  • →Review agent process-spawn logic to ensure URLs and other server-supplied strings are never concatenated directly into shell commands; use parameterized process execution instead.
  • →Monitor for command lines that combine a URL just fetched by the agent with shell metacharacters, eval/IEX calls, or encoded newlines.

Known benign look-alikes

  • Developer or CI shell one-liners that legitimately chain an OAuth/token endpoint call with another command (for example "curl https://host/oauth/token && curl https://host/mcp"). The host will appear in the command line and the agent will have fetched it, so this pattern can satisfy the correlation.
  • Reproduction of this CVE during authorised security research or regression testing of the MCP OAuth flow.
  • MCP server bootstrap scripts that pass a callback/redirect URL to "bash -c", "cmd /c start" or "osascript -e" as part of a normal browser-based consent flow, where the URL happens to contain a percent-encoded newline or a backtick from an over-eager template.
  • Agent-driven token debugging that pipes an OAuth response through base64 or a shell interpreter in the same command line.

References