OAuth Discovery as an RCE Vector CVE-2025-6514 in mcp-remote...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://amlalabs.com/blog/oauth-cve-2025-6514/
• Blog Title: OAuth Discovery as an RCE Vector: CVE-2025-6514 in mcp-remote and Safer Agent Authorization
• Suggested Section: Pentesting Web -> OAuth to Account takeover (extend with a subsection on "OAuth/OIDC Discovery URL Abuse and OS Command Execution" describing abuse of server-controlled authorization_endpoint / IdP URLs passed to OS-level URL handlers in desktop/agent clients)

🎯 Content Summary

This blog discusses CVE-2025-6514, a critical OS command injection (CWE-78) in mcp-remote, a proxy used by MCP (Model Context Protocol) clients such as Claude Desktop, Cursor, and Windsurf to connect local STDIO-only MCP clients to remote HTTP(S) MCP servers. The article focuses less on new exploit primitives and more on the architectural security failure in OAuth-based discovery for autonomous agents.

Context and impact. CVE-2025-6514 affects m...

🔧 Technical Details

Abusing OAuth discovery with a malicious authorization_endpoint. The core trick is to exploit OAuth/OIDC discovery in automated clients: if a client asks a server for OAuth metadata and then opens the returned authorization_endpoint using OS-level helpers without strict validation, an attacker can supply a non-HTTP(S) URL or file URI pointing to a local executable (e.g., file:/c:/windows/system32/calc.exe). Any agent or desktop client that uses this pattern can be turned into a remote code execution vector whenever it connects to an untrusted or MITM-controlled server. To generalize this, always examine whether server-controlled metadata is passed directly into browser/URL opening APIs and ensure only well-formed, safe schemes and hosts are allowed.

Recognizing and eliminating trust inversion in agent OAuth flows. Agent-based systems often let arbitrary servers dictate where and how the agent should authenticate...

🤖 Agent Actions

Updated src/pentesting-web/oauth-to-account-takeover.md with a new section on OAuth/OIDC Discovery URL Abuse & OS Command Execution, detailing how malicious MCP servers weaponize authorization_endpoint values to trigger local OS handlers (per CVE-2025-6514), exploitation workflow, generalized conditions, and hardening guidance (scheme pinning, IdP allowlists, capability-based delegation, patched versions). Added the Amla Labs research URL to the References section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 935
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://amlalabs.com/blog/oauth-cve-2025-6514/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> OAuth to Account takeover (extend with a subsection on "OAuth/OIDC Discovery URL Abuse and OS Command Execution" describing abuse of server-controlled authorization_endpoint / IdP URLs passed to OS-level URL handlers in desktop/agent clients)".

Repository Maintenance:

• MD Files Formatting: 935 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0