Command Injection Vulnerability in fastly-mcp-server

[juruo123]

fastly-mcp-server Command Injection Vulnerability

1) CNA / Submission Type

• Submission type: Report a vulnerability (CVE ID request)
• Reporter role: Independent security researcher
• Report date: April 10, 2026

2) Reporter Contact (fill before submit)

• Reporter name: CPT_Penner
• Reporter email: 2568389294@qq.com
• Permission to share contact with vendor: Yes

3) Vendor / Product Identification

• Vendor: jackwrichards
• Product: fastly-mcp-server
• Repository: https://github.com/jackwrichards/FastlyMCP
• Reviewed local source path: datasets_set/001/datasets_001/jackwrichards_FastlyMCP
• Affected component(s):
• fastly-mcp.mjs

4) Vulnerability Type

• CWE: CWE-78 (OS Command Injection)
• Short title: OS command injection in the fastly_cli MCP tool

5) Affected Versions

• Confirmed affected: 0.1.0 (version declared in local dataset)
• Suspected affected range: versions containing the same request-to-sink flow documented below
• Fixed version: Not available at time of report (April 10, 2026)

6) Vulnerability Description (for CVE description field)

Source-code review of jackwrichards/FastlyMCP confirms that attacker-controlled MCP request data reaches a shell-executed Fastly CLI command. The fastly_cli tool accepts an arbitrary command string, appends it to a PowerShell command line, and executes it through child_process.exec. Because the input is interpreted by PowerShell, an attacker can inject additional commands and execute arbitrary OS commands with the privileges of the MCP server process.

7) Technical Root Cause

1. js/command-injection-from-request
   • Source: fastly-mcp.mjs:251 (request)
   • Sink: fastly-mcp.mjs:217
   • Sink code: \powershell -Command "${psCommand}"`,`

Manual review note:

• The separate CodeQL js/request-forgery-from-request hit in this repository points to fetch(url, options) where url is derived from a fixed Fastly API base URL plus a caller-controlled path. That behavior does not provide arbitrary-host SSRF and should not be treated as a second CVE from the currently reviewed source.

8) Attack Prerequisites

• Ability to invoke the exposed MCP tool or request handler that reaches fastly_cli.
• No patch or runtime policy that strips or allowlists the attacker-controlled command string before it reaches the PowerShell execution sink.

9) Proof of Concept / Reproduction Guidance

PoC transport: MCP JSON-RPC request to the fastly_cli tool.

Representative request:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"fastly_cli","arguments":{"command":"whoami; touch /tmp/fastlymcp-poc"}}}

Analysis:

• fastly-mcp.mjs defines fastly_cli with attacker-controlled command.
• executeFastlyCLI(command, ...) builds const psCommand = \fastly ${command} --token ${FASTLY_API_KEY}`and executes it throughexec(`powershell -Command "${psCommand}"`, ...)`.
• PowerShell metacharacters inside command are therefore interpreted rather than passed as inert data.
• The PoC uses ; because the code and inline comments explicitly assume PowerShell command chaining semantics.

10) Security Impact

• Confidentiality: High (host files, environment variables, credentials, and accessible data may be read).
• Integrity: High (attacker may alter files, install persistence, or tamper with local configuration).
• Availability: High (attacker may terminate services, consume resources, or execute destructive commands).
• Scope: Changed.

11) CVSS v3.1 Suggestion

• Suggested vector for deployments that expose the vulnerable handler to untrusted callers: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Suggested base score: 10.0 (Critical)
• If invocation is restricted to trusted authenticated operators, adjust PR accordingly.

12) Workarounds / Mitigations

• Remove shell-style free-form command execution from the fastly_cli tool.
• Replace the current design with a fixed allowlist of supported Fastly subcommands and a strict argument schema.
• Avoid exec with interpolated shell strings; prefer direct argument arrays and explicit executable invocation.
• Add authentication, authorization, audit logging, and rate limiting around sensitive MCP tools.

13) Recommended Fix

• Eliminate the direct request-to-shell data flow documented above.
• Parse and validate each Fastly CLI subcommand and argument separately before execution.
• Use non-shell execution primitives with fixed binaries and explicit argv construction.
• Add regression tests proving attacker-controlled values cannot escape argument boundaries.

14) References

• Repository: https://github.com/jackwrichards/FastlyMCP
• Package name: fastly-mcp-server
• Reviewed source file: fastly-mcp.mjs
• CWE-78: https://cwe.mitre.org/data/definitions/78.html

15) Credits

• Discoverer: Winegee
• Discovery method: Static analysis (CodeQL) plus repository source-code audit

16) Additional Notes for Form Mapping

• Issue status at report time: source-code confirmed in the local dataset.
• Dynamic exploit replay status: not performed in this audit turn.
• The previously grouped SSRF claim was removed after source re-triage because the reviewed code does not expose arbitrary-host request control.

[juruo123]

Testing the MCP server with MCP Inspector using the following PoC payload successfully launches the calculator. Using the same mechanism, arbitrary command execution can be achieved.

{
  "method": "tools/call",
  "params": {
    "name": "fastly_cli",
    "arguments": {
      "command": "whoami; calc.exe"
    },
    "_meta": {
      "progressToken": 1
    }
  }
}

If the target runs on Linux/macOS, replace calc.exe with gnome-calculator or open -a Calculator can also achieve arbitrary command execution.