Data Exfiltration via an MCP Server used by Cursor

Summary

The Backslash Security Research Team demonstrated that a Model Context Protocol (MCP) tool can be used as a vector for an indirect prompt injection attack on Cursor, potentially leading to the execution of malicious shell commands. The Backslash Security Research Team created a proof-of-concept MCP server capable of scraping webpages. When a user asks Cursor to use the tool to scrape a site containing a malicious prompt, the prompt is injected into Cursor’s context. The prompt instructs Cursor to execute a shell command to exfiltrate the victim’s AI agent configuration files containing credentials. Cursor does prompt the user before executing the malicious command, potentially mitigating the attack. Target: Cursor Actor: Backslash Security Research Team Procedure: 1. The researchers crafted a malicious prompt containing an instruction to execute the malicious shell command to exfiltrate the victim’s AI agent credentials. 2. The researchers created a malicious web site containing the malicious prompt. 3. The malicious prompt was hidden in the title tag of the webpage. 4. The researchers launched a web server to receive data exfiltrated from the victim. 5. When a user asked Cursor to use an MCP tool to scrape the malicious website, the contents of the malicious prompt was retrieved and ingested into Cursor’s context window. 6. When the MCP server scraped the malicious web site, it returned the injected prompt to the MCP client and poisoned the context of the Cursor LLM. Cursor executed the malicious prompt embedded in the website scraped by the MCP tool. 7. The prompt injection invoked Cursor’s ability to call command line tools via the `run_terminal_cmd` tool. Cursor prompted the user before executing a shell command, potentially mitigating this attack. 8. When the MCP server scraped the malicious web site, it returned the injected prompt to the MCP client and poisoned the context of the Cursor LLM. The shell command in the malicious prompt was obscured via base64 encoding, making it less clear to the user that something malicious may be executed.

Deployers

• Cursor

Tags

• MITRE ATLAS
• AML.CS0045