CVE-2025-35028: HexStrike AI MCP Server RCE Vulnerability

CVE-2025-35028 Overview

CVE-2025-35028 is a critical command injection vulnerability in the HexStrike AI MCP server's EnhancedCommandExecutor class. By providing a command-line argument starting with a semicolon (;) to an API endpoint, attackers can execute arbitrary commands in the context of the MCP server's normal privilege level—which is typically root. The vulnerability exists because there is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).

Critical Impact

Unauthenticated remote attackers can achieve arbitrary command execution with root privileges on affected HexStrike AI MCP server deployments, leading to complete system compromise.

Affected Products

• HexStrike AI MCP Server (commit 2f3a5512 and earlier)

Discovery Timeline

• November 30, 2025 - CVE-2025-35028 published to NVD
• December 1, 2025 - Last updated in NVD database

Technical Details for CVE-2025-35028

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the EnhancedCommandExecutor class, which constructs shell commands by concatenating user-supplied input without proper sanitization. When an attacker supplies input beginning with a semicolon character, the shell interprets this as a command separator, allowing the injection of arbitrary commands that execute with the server's privilege level.

Since the MCP server typically runs with root privileges, successful exploitation grants attackers complete control over the underlying system. The network-accessible nature of the API endpoint, combined with the lack of authentication requirements, makes this vulnerability particularly severe. An attacker requires no prior access or credentials to exploit this flaw—only network connectivity to the vulnerable endpoint.

Root Cause

The root cause is the absence of input sanitization in the EnhancedCommandExecutor class. When constructing commands from user-provided API arguments, the class directly concatenates input strings without escaping or validating shell metacharacters. The semicolon (;) character acts as a command separator in Unix shells, enabling attackers to terminate the intended command and inject their own malicious commands.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker sends a crafted HTTP request to an API endpoint exposed by the EnhancedCommandExecutor class, with a parameter value beginning with a semicolon followed by arbitrary shell commands. The composed command string is then passed to a shell interpreter, where the semicolon terminates the original command and the injected payload executes with root privileges.

The exploitation flow involves sending a malicious argument such as ; id; cat /etc/shadow to the vulnerable API endpoint. The server constructs a command string that, when executed by the shell, runs both the original intended command (which may fail or produce unexpected output) and the attacker's injected commands with full root access.

Detection Methods for CVE-2025-35028

Indicators of Compromise

• Unexpected or anomalous HTTP requests to HexStrike AI MCP server API endpoints containing semicolon characters in parameter values
• Process execution logs showing child processes spawned by the MCP server process that are inconsistent with normal operations
• Evidence of reconnaissance commands (id, whoami, uname) or data exfiltration attempts (cat /etc/passwd, cat /etc/shadow) in server logs
• Unexpected network connections originating from the MCP server to external addresses

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing shell metacharacters (;, |, &, backticks) in API parameters
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious child process creation from the MCP server process
• Enable comprehensive logging of all API requests and implement real-time analysis for command injection patterns
• Monitor for privilege escalation attempts or unusual file system access patterns originating from the MCP server context

Monitoring Recommendations

• Configure SIEM alerts for HTTP requests to MCP server endpoints containing shell command separator characters
• Establish baseline behavior for the MCP server process and alert on deviations such as unexpected network connections or file access
• Monitor system authentication logs for unauthorized access attempts following potential exploitation
• Implement network traffic analysis to detect data exfiltration or reverse shell connections originating from the server

How to Mitigate CVE-2025-35028

Immediate Actions Required

• Restrict network access to the HexStrike AI MCP server to trusted IP addresses only using firewall rules
• If possible, run the MCP server with reduced privileges instead of root to limit the impact of successful exploitation
• Implement a reverse proxy or WAF in front of the MCP server to filter malicious requests containing shell metacharacters
• Review server logs for evidence of exploitation and conduct incident response if compromise indicators are found

Patch Information

No official patch information is currently available. Organizations should monitor the GitHub Issue #115 for updates from the maintainers. Additional technical analysis is available at the TakeOnMe GCVE-1337 Analysis.

Workarounds

• Deploy network segmentation to isolate the MCP server from critical infrastructure and limit lateral movement potential
• Implement application-level input validation that rejects or escapes shell metacharacters before they reach the EnhancedCommandExecutor class
• Consider disabling or restricting access to the affected API endpoints until an official patch is available
• Run the MCP server in a containerized environment with restricted capabilities to minimize the impact of command execution

# Example: Restrict MCP server network access via iptables
# Allow only trusted management subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP