Used for model serialization and deserialization, with specific endpoints for loading models and making predictions. Includes potentially dangerous pickle functionality that can allow arbitrary code execution.
Damn Vulnerable Model Context Protocol (DVMCP)
A deliberately vulnerable implementation of a Model Context Protocol (MCP) server designed for security researchers and developers to learn about AI/ML model serving vulnerabilities.
⚠️ WARNING: This is a deliberately vulnerable application. DO NOT use in production environments.
Table of Contents
Related MCP server: Vulnerable MCP Server
Installation
Clone the repository:
Install dependencies:
Set up your Gemini API key:
Run the server:
Refer Client Integration File to understand how to interact with it
MCP Vulnerabilities
1. Model Context Manipulation
Vulnerability: Unrestricted modification of model context and system prompts.
How to Identify:
Check for direct context modification endpoints
Look for global state management
Examine system prompt handling
Example Exploit:
Impact:
Privilege escalation across model instances
System prompt poisoning
Cross-request data leakage
2. Prompt Injection
Vulnerability: Unsanitized prompt handling and context contamination.
How to Identify:
Look for direct prompt concatenation
Check for context persistence between requests
Examine system prompt handling
Example Exploit:
Impact:
System prompt disclosure
Context leakage
Cross-request prompt poisoning
3. Model Access Control Bypass
Vulnerability: Weak model access controls and capability validation.
How to Identify:
Check for capability verification
Look for API key handling
Examine rate limit implementation
Example Exploit:
Impact:
Unauthorized model access
Capability escalation
Rate limit bypassing
4. Model Chain Attacks
Vulnerability: Unrestricted model chaining and context persistence.
How to Identify:
Look for chain depth limits
Check for cycle detection
Examine context handling in chains
Example Exploit:
Impact:
Resource exhaustion
Infinite recursion
Context pollution across chains
5. Response Manipulation
Vulnerability: Template injection and system information exposure.
How to Identify:
Check for template usage
Look for response formatting
Examine system information handling
Example Exploit:
Impact:
API key exposure
System information disclosure
Template injection attacks
6. Rate Limit Bypassing
Vulnerability: Ineffective rate limiting implementation.
How to Identify:
Check rate limit enforcement
Look for request counting
Examine time window handling
Example Exploit:
Impact:
Cost escalation
Resource exhaustion
Service degradation
7. System Prompt Exposure
Vulnerability: Unprotected system prompt access and modification.
How to Identify:
Check system prompt storage
Look for prompt modification endpoints
Examine privilege checks
Example Exploit:
Impact:
System prompt disclosure
Privilege escalation
Security control bypass
8. Model Capability Enumeration
Vulnerability: Excessive information disclosure about model capabilities.
How to Identify:
Check model configuration exposure
Look for capability enumeration
Examine internal state disclosure
Example Exploit:
Impact:
Model capability exposure
Internal configuration leakage
Attack surface discovery
Security Impact on MCP
The vulnerabilities in this application demonstrate critical security concerns in Model Context Protocols:
Context Isolation Failure
Cross-request contamination
System prompt exposure
Privilege escalation
Model Access Control
Unauthorized model access
Capability bypass
Rate limit evasion
Resource Management
Chain-based DoS
Context exhaustion
Cost escalation
Information Disclosure
API key exposure
System configuration leakage
Internal state exposure
Mitigation Strategies
Context Security
Implement context isolation
Validate system prompts
Enforce context boundaries
Access Control
Implement proper authentication
Validate capabilities
Enforce rate limits
Chain Security
Implement depth limits
Add cycle detection
Isolate chain contexts
Response Security
Sanitize templates
Filter system information
Validate outputs
License
This project is licensed under the MIT License - see the LICENSE file for details.
Disclaimer
This application contains intentional vulnerabilities for educational purposes. It should only be used in controlled environments for learning about AI/ML system security.