Shell Command Injection via key_code in Mobile MCP Server

Vulnerability Overview This vulnerability involves Android shell command injection via the function in the Mobile MCP (Mobile Control Panel). An attacker can execute arbitrary Android shell commands, thereby gaining control over the device, by crafting specific parameters. Scope of Impact Affected Files: - - - Affected Versions: v3.0.10, v3.0.9 Remediation Plan 1. Input Validation: - In , strictly validate the parameter to ensure it only contains valid Android key codes (e.g., , , etc.) or non-negative decimal numbers. - Use the regular expression to verify the legitimacy of . 2. Code Modification: - Add the following code in to validate : 3. Test Cases: - Add test cases in to verify that the patched code correctly handles invalid input: ```python @pytest.mark.asyncio @pytest.mark.parametrize( "key_code", [ "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME&&echo AUDIT_MARKER", "KEYCODE_HOME "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo AUDIT_MARKER", "KEYCODE_HOME;echo

Goal Reached Thanks to every supporter — we hit 100%!

Shell Command Injection via key_code in Mobile MCP Server

More from this source