An unauthenticated remote code execution vulnerability in the GH05TCREW PentestAgent allows attackers to compromise the host system by injecting commands through the MCP HTTP server.

The application binds its MCP HTTP server to all network interfaces without authentication or access control, exposing the run_task function to unauthenticated remote attackers. This function allows for the execution of arbitrary shell commands on the host machine via the default LocalRuntime component, which lacks necessary sandboxing or command filtering.

Successful exploitation grants an attacker full remote code execution capabilities on the host running the agent. This level of access facilitates data theft, unauthorized system control, and potential lateral movement within the network. Given the CVSS score of 7.3, this vulnerability represents a high-severity risk that could lead to the complete compromise of the host environment and any sensitive information processed or stored by the agent.

Immediate Action: Restrict access to the PentestAgent service by binding the MCP HTTP server to 127.0.0.1 rather than 0.0.0.0. If the service must be exposed, implement a robust authentication layer or firewall the service to trusted IP addresses only.

Proactive Monitoring: Review application and system access logs for anomalous POST requests to the /mcp endpoint. Monitor for unexpected child processes spawned by the PentestAgent process, particularly those invoking shell utilities like curl, bash, or sh.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway in front of the service to block unauthorized access and inspect requests for malicious tool-call patterns. Ensure the service is run within a hardened containerized environment with minimal privileges and no direct access to sensitive system files.

Public Exploit Available: Yes — a published proof-of-concept exists (referenced in the GitHub issue tracker for the project).

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to isolate the PentestAgent service. Administrators should ensure the service is not exposed to the public internet and apply the recommended network restrictions until a formal patch is integrated into the upstream repository.