Skip to content

feat(SAFE-T1005): added [Exposed Endpoint Exploit] #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adhikariraju38 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(SAFE-T1005): added [Exposed Endpoint Exploit] #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ The SAFE-MCP framework defines 14 tactics that align with the MITRE ATT&CK metho
| ATK-TA0001 | Initial Access | [SAFE-T1002](techniques/SAFE-T1002/README.md) | Supply Chain Compromise | Distribution of backdoored MCP server packages through unofficial repositories or compromised legitimate sources |
| ATK-TA0001 | Initial Access | [SAFE-T1003](techniques/SAFE-T1003/README.md) | Malicious MCP-Server Distribution | Adversary ships a trojanized server package or Docker image that users install, gaining foothold when the host registers its tools |
| ATK-TA0001 | Initial Access | [SAFE-T1004](techniques/SAFE-T1004/README.md) | Server Impersonation / Name-Collision | Attacker registers a server with the same name/URL as a trusted one, or hijacks discovery, so the client connects to them instead |
| ATK-TA0001 | Initial Access | SAFE-T1005 | Exposed Endpoint Exploit | Misconfigured public MCP endpoints (no auth, debug on) let attackers connect, enumerate tools or trigger RCE |
| ATK-TA0001 | Initial Access | [SAFE-T1005](techniques/SAFE-T1005/README.md) | Exposed Endpoint Exploit | Misconfigured public MCP endpoints (no auth, debug on) let attackers connect, enumerate tools or trigger RCE |
| ATK-TA0001 | Initial Access | [SAFE-T1006](techniques/SAFE-T1006/README.md) | User-Social-Engineering Install | Phishing/social posts persuade developers to "try this cool tool"; the installer silently registers dangerous capabilities |
| ATK-TA0001 | Initial Access | [SAFE-T1007](techniques/SAFE-T1007/README.md) | OAuth Authorization Phishing | Malicious MCP servers exploit OAuth flows to steal access tokens from legitimate services by tricking users during authorization |
| ATK-TA0001 | Initial Access | [SAFE-T1008](techniques/SAFE-T1008/README.md) | Tool Shadowing Attack | Malicious MCP servers impersonate or interfere with legitimate tools to hijack execution within MCP-based workflows through cross-server tool interference |
Expand Down
Loading