| 제목 | sworddut mcp-ffmpeg-helper (FFmpeg MCP Server; npm @sworddut/mcp-ffmpeg-helper) <=0.2.1 (0.1.0, 0.1.1, 0.2.1; no fixed release) OS Command Injection |
|---|
| 설명 | A vulnerability was found in sworddut mcp-ffmpeg-helper (FFmpeg MCP Server), all published versions up to and including 0.2.1 (0.1.0, 0.1.1, 0.2.1; no fixed release exists). The MCP tool handler handleToolCall() in src/tools/handlers.ts builds ffmpeg command strings by directly interpolating tool-call arguments into a shell command without validation, quoting or escaping. In the extract_audio tool the format parameter is taken as String(args?.format || 'mp3') (handlers.ts line 42) and concatenated unquoted into: -i "${inputPath}" -vn -acodec ${format} "${outputPath}" -y (handlers.ts line 45). That string is passed to runFFmpegCommand() in src/utils/ffmpeg.ts, which executes it through child_process.spawn(command, args, { shell: true }). Because the shell interprets the string, shell metacharacters in format (or in the other unvalidated parameters options, codec, pixelFormat, extraOptions, startTime, duration, endTime, and the extract_frames format) break out of the intended ffmpeg invocation and run arbitrary operating-system commands with the privileges of the process hosting the MCP server. The arguments originate from LLM/agent tool-call input, so the flaw is reachable through indirect prompt injection or attacker-controlled content or filenames the agent is asked to process. This is genuine OS command injection (CWE-78), not merely ffmpeg-argument injection; no sanitization guard exists on the path (validatePath() only performs an existsSync check on input paths and does not touch these parameters).
Proof of concept (benign, local only): npm i @sworddut/mcp-ffmpeg-helper ; printf '' > /tmp/in.mp4 ; then call handleToolCall('extract_audio', {inputPath:'/tmp/in.mp4', outputPath:'/tmp/out.mp3', format:'mp3 ; id > /tmp/kholiev_ffmpeg_poc.txt ; true'}). The string handed to the shell becomes: ffmpeg -i "/tmp/in.mp4" -vn -acodec mp3 ; id > /tmp/kholiev_ffmpeg_poc.txt ; true "/tmp/out.mp3" -y , which creates /tmp/kholiev_ffmpeg_poc.txt containing the output of id, proving arbitrary command execution. The proof of concept is non-destructive and performs no network activity.
Suggested fix: invoke ffmpeg with an argument array and shell:false (each option and path a discrete argv element), and allowlist the format/codec parameters.
CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Base 7.8). CWE-78.
Public reference (coordinated disclosure): https://github.com/sworddut/mcp-ffmpeg-helper/issues/6
npm: https://www.npmjs.com/package/@sworddut/mcp-ffmpeg-helper
Researcher: Mykhailo Kholiev. |
|---|
| 원천 | ⚠️ https://github.com/sworddut/mcp-ffmpeg-helper/issues/6 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 07. 11. PM 12:30 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 24. PM 05:41 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394711 [sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1 Tool src/tools/handlers.ts handleToolCall format 권한 상승] |
|---|
| 포인트들 | 20 |
|---|