Summary
A command injection vulnerability in Microsoft UFO's mobile MCP press_key tool allows an authenticated caller to supply shell metacharacters through the key_code parameter. When the resulting command is processed by Android's shell on an authorized connected device, the caller may execute additional commands with Android shell-user privileges.
A command injection vulnerability in Microsoft UFO's mobile MCP press_key tool allows an authenticated caller to supply shell metacharacters through the key_code parameter. When the resulting command is processed by Android's shell on an authorized connected device, the caller may execute additional commands with Android shell-user privileges.
Affected context
The issue occurs in UFO deployments before version 3.0.9 when all of the following conditions are present:
- The Mobile MCP HTTP server exposes the
press_keytool. - The caller possesses a valid
UFO_MCP_API_KEY. - The host has access to the Android Debug Bridge (
adb). - A reachable, authorized Android device is connected.
- User-controlled
key_codedata is incorporated into anadb shell input keyeventcommand that is reparsed by the Android shell.
The resulting execution is limited by the Android shell user's permissions and does not inherently provide host operating-system or Android root access.
The issue occurs in UFO deployments before version 3.0.9 when all of the following conditions are present:
- The Mobile MCP HTTP server exposes the
press_keytool. - The caller possesses a valid
UFO_MCP_API_KEY. - The host has access to the Android Debug Bridge (
adb). - A reachable, authorized Android device is connected.
- User-controlled
key_codedata is incorporated into anadb shell input keyeventcommand that is reparsed by the Android shell.
The resulting execution is limited by the Android shell user's permissions and does not inherently provide host operating-system or Android root access.
Exploit preconditions
- Attack surface: The authenticated Mobile MCP HTTP interface and its
press_keytool - Required access: A valid UFO MCP API key and authorization to invoke the tool
- Required environment: An available
adbclient and a reachable, authorized Android device - Trigger point: Processing of the free-form
key_codevalue by theadb shell input keyeventcommand - Why exploitation is possible: User input is incorporated into a command string that is subsequently reparsed by a shell, allowing command syntax to be interpreted rather than treated solely as key-event data
- Attack surface: The authenticated Mobile MCP HTTP interface and its
press_keytool - Required access: A valid UFO MCP API key and authorization to invoke the tool
- Required environment: An available
adbclient and a reachable, authorized Android device - Trigger point: Processing of the free-form
key_codevalue by theadb shell input keyeventcommand - Why exploitation is possible: User input is incorporated into a command string that is subsequently reparsed by a shell, allowing command syntax to be interpreted rather than treated solely as key-event data
Why this happens
The underlying flaw is OS command injection caused by passing insufficiently constrained user input into a shell-mediated command. The press_key tool accepts a free-form value, while the ADB client and remote Android shell join and reparse command arguments. This creates a boundary where data intended to represent a key code can instead influence shell command interpretation, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The underlying flaw is OS command injection caused by passing insufficiently constrained user input into a shell-mediated command. The press_key tool accepts a free-form value, while the ADB client and remote Android shell join and reparse command arguments. This creates a boundary where data intended to represent a key code can instead influence shell command interpretation, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- An authenticated caller may execute additional commands on an authorized Android device.
- Device data or application state could be accessed, modified, or disrupted within Android shell-user permissions.
- Device-side automation workflows could be altered or abused.
- The device could be used to affect connected services or test environments accessible to that account.
- The vulnerability does not, by itself, establish host operating-system execution or Android root privileges.
- An authenticated caller may execute additional commands on an authorized Android device.
- Device data or application state could be accessed, modified, or disrupted within Android shell-user permissions.
- Device-side automation workflows could be altered or abused.
- The device could be used to affect connected services or test environments accessible to that account.
- The vulnerability does not, by itself, establish host operating-system execution or Android root privileges.
General mitigation guidance
Mitigation focuses on ensuring that key-event input remains data rather than shell syntax.
Common defensive patterns include:
- Replacing shell-mediated command construction with an argument-safe process or ADB API where available.
- Restricting
key_codeto an explicit allowlist of valid numeric or symbolic key codes. - Rejecting shell metacharacters, whitespace, unexpected delimiters, and other nonconforming input before command dispatch.
- Avoiding string concatenation or argument joining when invoking local or remote shell commands.
- Applying least privilege to the MCP service, ADB connection, and Android automation account.
- Limiting connected devices and MCP tool permissions to only the workflows that require them.
- Treating authenticated API callers as untrusted for command-construction purposes and enforcing authorization at the tool level.
Mitigation focuses on ensuring that key-event input remains data rather than shell syntax.
Common defensive patterns include:
- Replacing shell-mediated command construction with an argument-safe process or ADB API where available.
- Restricting
key_codeto an explicit allowlist of valid numeric or symbolic key codes. - Rejecting shell metacharacters, whitespace, unexpected delimiters, and other nonconforming input before command dispatch.
- Avoiding string concatenation or argument joining when invoking local or remote shell commands.
- Applying least privilege to the MCP service, ADB connection, and Android automation account.
- Limiting connected devices and MCP tool permissions to only the workflows that require them.
- Treating authenticated API callers as untrusted for command-construction purposes and enforcing authorization at the tool level.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that identify user-controlled values entering shell commands, subprocess calls, ADB wrappers, or remote command builders.
- Code review checks for string concatenation, generic argument joining, shell-enabled process execution, and free-form parameters mapped to command-line options.
- Tests that verify invalid key-code formats are rejected and that special shell syntax is never interpreted.
- Runtime monitoring of MCP tool invocations, unusual key-code values, unexpected ADB command activity, and device-side process creation.
- Policy enforcement requiring allowlisted inputs and argument-safe execution APIs for automation services.
- Neutral automated code-review or software-composition tools that flag command-injection patterns and insecure process invocation.
Organizations can look for this class of issue through:
- Static analysis rules that identify user-controlled values entering shell commands, subprocess calls, ADB wrappers, or remote command builders.
- Code review checks for string concatenation, generic argument joining, shell-enabled process execution, and free-form parameters mapped to command-line options.
- Tests that verify invalid key-code formats are rejected and that special shell syntax is never interpreted.
- Runtime monitoring of MCP tool invocations, unusual key-code values, unexpected ADB command activity, and device-side process creation.
- Policy enforcement requiring allowlisted inputs and argument-safe execution APIs for automation services.
- Neutral automated code-review or software-composition tools that flag command-injection patterns and insecure process invocation.
