# Yii2-MCP-Server Command Injection Vulnerability Summary ## Vulnerability Overview A command injection vulnerability (CWE-78) was discovered in `yii2-mcp-server` version 1.0.2. The vulnerability exists in the `yii_command_help` and `yii_execute_command` command utilities. The server constructs shell command strings by concatenating user-provided parameters (such as `command` and `args`) and executes them using `child_process.exec` without escaping or filtering special characters. Attackers can inject shell metacharacters (e.g., `;`, `|`) via the MCP interface to execute arbitrary system commands with the privileges of the server process. ## Affected Scope * **Affected Version**: 1.0.2 * **Affected Components**: `src/index.ts`, `src/yii2.ts` * **Security Impact**: * **Confidentiality**: High (ability to read environment variables, application keys, database credentials, etc.). * **Integrity**: High (ability to modify files and application state). * **Availability**: High (ability to terminate processes, delete data, and exhaust resources). * **CVSS v3.1 Score**: 8.8 (High) ## Remediation 1. **Avoid String Concatenation**: Do not construct shell commands by concatenating strings. 2. **Use Safe Execution Methods**: Replace `exec` or `execAsync` with `execFile` or `spawn`, and pass arguments using an array (e.g., `spawn('php', [this.yiiScript, 'help', command], { shell: false })`). 3. **Input Validation**: Validate that `command` and `args` conform to the expected Yii command names and option formats. 4. **Reject Illegal Characters**: Reject MCP requests containing shell metacharacters and unsupported parameters. 5. **Unified Execution Mode**: Apply the same secure execution pattern to all methods that construct shell strings. 6. **Regression Testing**: Add regression tests for injection payloads such as `;`, `|`, and `$()`. ## POC Code **1. Exploiting the `yii_command_help` utility:** ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "yii_command_help", "arguments": { "command": "migrate/status; id" } } } ``` **2. Exploiting the `yii_execute_command` utility:** ```json { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "yii_execute_command", "arguments": { "command": "help", "args": ["migrate/status;", "id"], "interactive": false } } } ```