T07 · Tool Hijacking and Spoofing
Warning
- Location
- SKILL.md:46
- Finding
- PATH-Based Executable Spoofing in MCP Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 46-51 **Vulnerability Type**: Unverified PATH-resolved executable invocation **Risk Level**: Medium The documented MCP configuration invokes `agentic-route` using a bare executable name: ```json { "mcpServers": { "agentic-route": { "command": "agentic-route", "args": ["mcp"] } } } ``` ### Technical Analysis The MCP host resolves the `agentic-route` command through the process environment's `PATH`. The project contains only `SKILL.md` and does not include the referenced executable, a trusted installation source, a pinned version, an integrity checksum, or a verified absolute path. Consequently, the MCP configuration cannot ensure that the program it launches is the intended implementation. An attacker who can place or replace an executable named `agentic-route` in a directory searched before the legitimate installation can cause the MCP host to execute attacker-controlled code. This is a tool-spoofing risk rather than evidence that this package itself contains malicious executable code. The actual behavior of the advertised Bash/Rust engine also cannot be audited because its implementation is absent. ### Attack Path 1. A user or administrator copies the documented MCP configuration into an Agent or MCP host configuration. 2. An attacker gains write access to a directory that appears early in the MCP host's `PATH`, or influences the environment used to launch that host. 3. The attacker places a malicious executable named `agentic-route` in that directory. 4. The MCP host processes the configuration and resolves the bare `agentic-route` command through `PATH`. 5. The malicious executable is launched with the `mcp` argument. 6. The executable runs with the operating-system privileges and environment access of the MCP host process. ### Impact Assessment Successful exploitation permits arbitrary code execution under the ...[truncated 546 chars]
- Remediation
- ## Remediation Suggestions 1. Distribute the actual `agentic-route` implementation through a documented and authenticated installation channel. 2. Pin the installed release to a reviewed version and publish a cryptographic checksum or signed release artifact. 3. Configure MCP with a verified absolute executable path instead of the bare `agentic-route` command. 4. Ensure the executable and all parent directories are owned by a trusted administrator and are not writable by unprivileged users. 5. Launch the MCP server with a minimal, explicitly defined `PATH` and a dedicated least-privileged service account. 6. Audit the missing implementation before deployment, especially the documented packet-capture, routing-rule modification, encrypted-DNS interception, database-access, REST API, and MCP server functionality. 7. Document the expected executable identity, installation location, permissions, version, and integrity-verification procedure so operators can validate it before activation.