Authenticated Android Shell Command Injection in Mobile MCP 'press_key'

Vulnerability Overview Authenticated Android shell command injection in Mobile MCP 'press_key' Vulnerability Type: Command Injection Severity: Critical (CVSS v3 base metrics: 8.1/10) Affected Versions: Current 'main' at commit Fixed Versions: None Scope of Impact Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Scope: Changed Confidentiality: Low Integrity: High Availability: Low Remediation Current Status: Unpatched Detailed Description Summary The Mobile MCP server exposes a tool that forwards the user-controlled string to . Since merges remaining parameters into a single remote shell command without escaping, authenticated Mobile MCP callers can inject arbitrary Android shell metacharacters into the . This allows the execution of arbitrary commands as the Android shell user on attached, authorized Android devices. This issue requires a valid Mobile MCP API key and accessibility to the Mobile MCP server. Details Vulnerability Code Location: Vulnerable Tool: tool Vulnerable Code: Vulnerability Cause: is a free-form string passed as an argument to . While avoids host shell interpretation, this does not prevent command injection on the Android device. The Android adb client constructs the remote command by concatenating parameters after with spaces. Example: - Expected Command: - Exploitable As: Proof of Concept (PoC) Prerequisites: The Mobile MCP server is running and accessible. The caller has a valid bearer token configured with the . is installed on the host. At least one Android device or emulator is connected and authorized for ADB. The Mobile MCP server exposes the tool via streaming HTTP. Synthetic Non-Destructive Reproduction: 1. Start the Mobile MCP server and configure the API key. 2. Connect to the Mobile MCP endpoint using a valid bearer token. 3. Invoke the tool with the following parameters: 4. Observe that the command sent via ADB is semantically equivalent to: Expected Secure Behavior: The server should treat the input as an invalid key code and reject it. Observed Vulnerable Behavior (Static Analysis): The input reaches as part of a concatenated remote shell command, allowing additional Android shell commands to be appended after the semicolon. Impact This is a command injection vulnerability on devices connected to an Android device. An authenticated Mobile MCP caller can execute arbitrary Android shell commands as the Android shell user on any authorized device accessible via the server's ADB configuration. Impacts include unauthorized device interaction, reading data accessible to the user, modifying settings, and disrupting device state. This does not, by itself, establish host operating system command execution, Android root execution, or access to private application data outside the Android shell user privileges.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated Android Shell Command Injection in Mobile MCP 'press_key'

More from this source