title: SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag
id: ATR-2026-02370
rule_version: 1
status: experimental
description: |
  Detects an SSH/SCP-style MCP tool call whose host-identifier argument (hostAlias / ssh_host / target_host) begins with a dash, making it parse as an SSH client option rather than a hostname -- most critically -oProxyCommand=/-oProxyJump=/-oPermitLocalCommand= (arbitrary local command execution before any network connection) or -w (port-forwarding/tunnel option injection). Also detects the companion Windows-specific vector: an scp localPath/remotePath argument chained with a shell metacharacter (&, |, ^) directly into a Windows executable, which is exploitable because the vulnerable server invoked ssh.exe/scp.exe via spawn(..., {shell:true}), letting cmd.exe re-parse every argument. Mined from GHSA-p4h8-56qp-hpgv (@aiondadotcom/mcp-ssh): the MCP server runs locally over stdio but the LLM driving it is not trusted -- its tool arguments can be steered by prompt injection from any untrusted text the agent ingests (web pages, e-mails, repository files, other MCP servers' output), so no malicious user is required, only that the agent process attacker-controlled text at some point in the session. Generalized beyond the one package name to any SSH/SCP-wrapping MCP tool that forwards a host-identifier argument to the ssh/scp binary without an argument terminator or leading-dash rejection.
author: ATR Community (CVE sweep)
date: 2026/07/11
schema_version: '0.1'
detection_tier: pattern
maturity: experimental
severity: high
references:
  ghsa:
    - GHSA-p4h8-56qp-hpgv
  cwe:
    - CWE-78
    - CWE-88
  owasp_llm:
    - LLM01:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI02:2026
  mitre_attack:
    - T1059.004 - Unix Shell
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
  external:
    - https://github.com/AiondaDotCom/mcp-ssh/security/advisories/GHSA-p4h8-56qp-hpgv
    - https://github.com/AiondaDotCom/mcp-ssh/issues/9
    - https://github.com/AiondaDotCom/mcp-ssh/releases/tag/1.3.5
metadata_provenance:
  ghsa: human-reviewed
  cwe: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  mitre_attack: human-reviewed
  mitre_atlas: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to third parties altering system behaviour through vulnerability exploitation; this rule detects SSH/SCP option-injection tool arguments that achieve local code execution before any network connection is made.
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the SSH-tool option-injection risk class.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MG.2.3
      context: Treating SSH/SCP option injection in tool arguments as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
      strength: primary
    - subcategory: MP.5.1
      context: Identifying SSH-tool argument option-injection as an AI risk to be catalogued in the organizational risk register.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of SSH/SCP option-injection tool arguments.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the local-RCE attempt.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: ssh-mcp-option-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: (?i)\b(?:host[_-]?alias|ssh_?host|target_?host)\b\s*[=:]\s*["'`]?-o\s*(?:proxycommand|proxyjump|permitlocalcommand)\s*=
      description: SSH/SCP host-identifier argument set to an OpenSSH option-injection flag (-oProxyCommand=/-oProxyJump=/-oPermitLocalCommand=) instead of an ordinary host name -- GHSA-p4h8-56qp-hpgv primary primitive
    - field: content
      operator: regex
      value: (?i)\b(?:host[_-]?alias|ssh_?host|target_?host)\b\s*[=:]\s*["'`]?-w\s*\d+(?::\d+)?\b
      description: SSH host-identifier argument carrying the -w (tunnel/port-forward) option-injection flag with real port-forward syntax (requires at least one digit, e.g. -w0:0 or -w2222) -- a bare '-w' with no digits is excluded to avoid flagging an implausible-but-conceivable literal alias name
    - field: content
      operator: regex
      value: (?i)\b(?:local|remote)_?path\b\s*[=:]\s*["'`]?[^"'`\n]{0,20}[&|^]\s*(?:calc\.exe|cmd\.exe|powershell|certutil|mshta|rundll32|wscript|cscript)\b
      description: scp local/remote path argument chained with a Windows shell metacharacter into a suspicious executable -- GHSA-p4h8-56qp-hpgv Windows spawn(shell:true) re-parse vector
  false_positives:
    - 'A hostAlias/ssh_host value that is an ordinary hostname or an entry from ~/.ssh/config, with no leading dash (e.g. hostAlias: "prod-db-01")'
    - Documentation or a patch changelog discussing the -oProxyCommand option-injection class without an actual tool-call argument being set to it
    - A localPath/remotePath value that happens to contain an ampersand in a filename (e.g. 'Q&A notes.txt') with no following executable token
    - A bare '-w' with no digits following it (e.g. an implausible but conceivable literal alias name) -- ADVERSARIALLY CONFIRMED as a corner-case during review; the -w condition now requires real port-forward syntax (at least one digit, e.g. -w0:0 or -w2222)
response:
  actions:
    - block_input
    - alert
  message_template: |
    [ATR-2026-02370] SSH/SCP tool argument carries an option-injection flag or Windows shell-metacharacter chain -- treat as an attempt at local code execution via the SSH/SCP MCP tool, not a normal connection.
confidence: 82