Summary
Codefriar sf-mcp through version 1.3.2 contains an OS command injection vulnerability in the handling of Salesforce CLI tool flag values. If an attacker can supply or influence these values, shell metacharacters may reach command execution and run with the MCP server user's privileges.
Codefriar sf-mcp through version 1.3.2 contains an OS command injection vulnerability in the handling of Salesforce CLI tool flag values. If an attacker can supply or influence these values, shell metacharacters may reach command execution and run with the MCP server user's privileges.
Affected context
The vulnerability occurs in deployments using Codefriar sf-mcp through 1.3.2 when Salesforce CLI flag values are incorporated into shell commands. The risk is present when attacker-influenced values pass through the server's escaping logic and are subsequently processed by the synchronous command execution path.
The vulnerability occurs in deployments using Codefriar sf-mcp through 1.3.2 when Salesforce CLI flag values are incorporated into shell commands. The risk is present when attacker-influenced values pass through the server's escaping logic and are subsequently processed by the synchronous command execution path.
Exploit preconditions
- Attack surface: MCP server functionality that invokes Salesforce CLI tools - Required access: Ability to submit or influence Salesforce CLI tool flag
values through an exposed MCP operation
- Trigger point: Processing of the supplied values by executeSfCommand - Why exploitation is possible: escapeValue() does not neutralize all shell
metacharacters, allowing attacker-controlled input to alter the interpreted
shell command
- Attack surface: MCP server functionality that invokes Salesforce CLI tools - Required access: Ability to submit or influence Salesforce CLI tool flag
values through an exposed MCP operation
- Trigger point: Processing of the supplied values by executeSfCommand - Why exploitation is possible: escapeValue() does not neutralize all shell
metacharacters, allowing attacker-controlled input to alter the interpreted
shell command
Why this happens
The underlying bug is incomplete shell-command escaping. Values intended to be treated as data are passed into a command string after an escaping routine that does not account for command substitution, backticks, and other shell control characters. This maps to CWE-78, where externally influenced input reaches an operating-system command interpreter without sufficient neutralization or separation from command syntax.
The underlying bug is incomplete shell-command escaping. Values intended to be treated as data are passed into a command string after an escaping routine that does not account for command substitution, backticks, and other shell control characters. This maps to CWE-78, where externally influenced input reaches an operating-system command interpreter without sufficient neutralization or separation from command syntax.
Potential impact
- An attacker may execute arbitrary commands with the MCP server user's privileges.
- The attacker could read, modify, or delete data accessible to the server.
- Application credentials, tokens, or configuration data could be exposed.
- The compromised process could be used for further lateral movement or service disruption.
- An attacker may execute arbitrary commands with the MCP server user's privileges.
- The attacker could read, modify, or delete data accessible to the server.
- Application credentials, tokens, or configuration data could be exposed.
- The compromised process could be used for further lateral movement or service disruption.
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from becoming shell syntax. Prefer direct process-execution APIs that pass executable names and arguments separately, rather than constructing commands for a shell. Apply strict allowlists and type-aware validation to CLI flags, reduce input trust boundaries, and reject unexpected option forms. If shell invocation cannot be avoided, use a well-tested escaping mechanism appropriate to the target shell and keep command construction centralized. Run the MCP server with a dedicated least-privilege account, restrict filesystem and network access, and avoid exposing sensitive credentials to the process.
Mitigation generally focuses on preventing untrusted values from becoming shell syntax. Prefer direct process-execution APIs that pass executable names and arguments separately, rather than constructing commands for a shell. Apply strict allowlists and type-aware validation to CLI flags, reduce input trust boundaries, and reject unexpected option forms. If shell invocation cannot be avoided, use a well-tested escaping mechanism appropriate to the target shell and keep command construction centralized. Run the MCP server with a dedicated least-privilege account, restrict filesystem and network access, and avoid exposing sensitive credentials to the process.
How teams detect issues like this
Detection can include static analysis for string concatenation or interpolation into execSync, shell-spawning APIs, and custom escaping functions that lack coverage for command substitution and shell metacharacters. Code review should examine every path from MCP parameters to process execution and verify that arguments remain separated from command syntax. Runtime monitoring can alert on unexpected child processes, command interpreters, or anomalous commands spawned by the MCP service. Automated code-review and SAST tools may help identify these patterns when configured for command-injection rules.
Detection can include static analysis for string concatenation or interpolation into execSync, shell-spawning APIs, and custom escaping functions that lack coverage for command substitution and shell metacharacters. Code review should examine every path from MCP parameters to process execution and verify that arguments remain separated from command syntax. Runtime monitoring can alert on unexpected child processes, command interpreters, or anomalous commands spawned by the MCP service. Automated code-review and SAST tools may help identify these patterns when configured for command-injection rules.
