Critical Unauthenticated Remote Code Execution in CircleCI's...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://remedio.io/blog/the-critical-unauthenticated-rce-vulnerability-in-circlecis-mcp-server
• Blog Title: Critical Unauthenticated Remote Code Execution in CircleCI's MCP Server
• Suggested Section: Pentesting CI/CD > CircleCI Security > CircleCI MCP Server Host/Origin Authentication Bypass to Pipeline RCE

🎯 Content Summary

Overview
Remedio identified a critical unauthenticated remote code execution vulnerability in CircleCI's MCP server when it is operated as a shared, network-reachable service. In this deployment mode, one MCP instance may be used by an entire team or multiple AI agents and carries the organization's CircleCI API token to perform delegated actions. A remote attacker who can reach the service can bypass its Host/Origin request validation and invoke th...

🔧 Technical Details

Bypassing access controls based on client-controlled HTTP headers
HTTP Host and Origin values are request metadata, not caller authentication. If an application allows a missing Origin to support clients such as curl and simultaneously trusts an allowlisted value such as Host: localhost, a direct client can omit Origin and spoof the allowed host. Test these controls with absent, empty, whitespace-only, mixed-case, and attacker-selected header values. Missing identity signals should fail closed, and authentication must use credentials or cryptographic identities that the requester cannot simply choose.

Spoofing loopback identity against wildcard-bound services
A process listening on 0.0.0.0 accepts traffic through non-loopback interfaces even when the request claims Host: localhost. The header describes the requested virtual host and ...

🤖 Agent Actions

Updated src/pentesting-ci-cd/circleci-security.md with:

• CircleCI MCP shared-token deployment preconditions.
• Host/missing-Origin bypass testing commands.
• run_pipeline access-to-RCE chain.
• Detection and event-correlation guidance.
• Version 0.19.2 remediation and configuration hardening.
• Numbered references to the Remedio research and official GitHub advisory.

Validation passed with git diff --check and citation/reference checks. mdbook was not installed, so the full build was skipped.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 590
• MD files fixed: 590

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://remedio.io/blog/the-critical-unauthenticated-rce-vulnerability-in-circlecis-mcp-server

Content Categories: Based on the analysis, this content was categorized under "Pentesting CI/CD > CircleCI Security > CircleCI MCP Server Host/Origin Authentication Bypass to Pipeline RCE".

Repository Maintenance:

• MD Files Formatting: 590 files processed (590 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0