# MCP StreamableHttp OAuth Redirect URL Command Injection

- **Severity:** High
- **Signature ID:** `7f3c1e94-2b6a-4d58-9c07-e1a5d84b6f21`

## Summary

Some AI agent clients that speak the MCP protocol will fetch an OAuth authorization URL from a remote MCP server and then hand that URL, unsanitized, to a spawned shell command. If the server returns a malicious URL containing shell metacharacters, it can run arbitrary commands on the machine hosting the agent. This affects Cherry Studio versions 1.5.1 and earlier.

## How the attack works

The agent (or an MCP client helper it spawns) connects to a streamableHttp MCP server and requests an OAuth authorization/redirect endpoint. The malicious server replies with a URL that contains shell injection syntax, such as backticks, $(), a percent-encoded newline, or an eval/IEX call, disguised as part of the redirect. The client then passes this URL straight into a new process's command line without sanitizing it, so the injected characters get interpreted by the shell and execute attacker-controlled commands. Optionally, the resulting rogue process reaches back out to a remote host, confirming a second-stage payload download.

## Why it matters

An attacker running a rogue or compromised MCP server can achieve remote code execution on the machine running the vulnerable MCP client, using nothing more than a crafted OAuth redirect response.

## What you can do

- Upgrade or patch any MCP client (such as Cherry Studio) that passes OAuth redirect URLs to spawned processes without sanitizing them.
- Restrict which MCP servers your agents are allowed to connect to, and treat OAuth/redirect URLs from untrusted servers as untrusted input.
- Review agent process-spawn logic to ensure URLs and other server-supplied strings are never concatenated directly into shell commands; use parameterized process execution instead.
- Monitor for command lines that combine a URL just fetched by the agent with shell metacharacters, eval/IEX calls, or encoded newlines.

## Known benign look-alikes

- Developer or CI shell one-liners that legitimately chain an OAuth/token endpoint call with another command (for example "curl https://host/oauth/token && curl https://host/mcp"). The host will appear in the command line and the agent will have fetched it, so this pattern can satisfy the correlation.
- Reproduction of this CVE during authorised security research or regression testing of the MCP OAuth flow.
- MCP server bootstrap scripts that pass a callback/redirect URL to "bash -c", "cmd /c start" or "osascript -e" as part of a normal browser-based consent flow, where the URL happens to contain a percent-encoded newline or a backtick from an over-eager template.
- Agent-driven token debugging that pipes an OAuth response through base64 or a shell interpreter in the same command line.

## References

- https://github.com/CherryHQ/cherry-studio
- https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization
- https://owasp.org/Top10/A03_2021-Injection/
- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/

---
Source: https://www.netzilo.com/threats/mcp-oauth-redirect-url-rce