exoproc

w0ldan/exoproc

Exoproc is a command-line tool and AI agent server for inspecting, modifying, and reverse-engineering running Windows and Java programs. Because it enables unrestricted shell commands, custom code execution, and memory editing by default—and opens unauthenticated helper servers on your network—a tricked AI agent or a local network attacker could take full control of your computer.

What it can reach

Shell commands

Runs arbitrary shell commands and starts new programs on the computer.

System

Attaches to running Windows and Java programs, reads and alters their memory, injects custom code, hijacks program threads, and captures desktop screenshots.

Files

Reads, writes, and deletes local files, including AI agent settings, logs, JAR archives, saved screenshots, and cached binary tools.

Network

Downloads external binary tools from GitHub and Maven repositories, and runs local HTTP and TCP servers for Java and Minecraft analysis.

Findings

1. HighUnauthenticated Java agent HTTP RPC server binds to all interfaces with wildcard CORS

   packages/java/agent/src/agent-class-builder.ts:346

   When the Exoproc Java agent is started inside a target JVM, it creates an HTTP server using new InetSocketAddress(activePort), which binds to 0.0.0.0 (all network interfaces) on port 43378 by default. It also sets Access-Control-Allow-Origin: * and requires no authentication for endpoints such as /reflection/invoke and /reflection/construct. Any attacker on the local network, or any malicious website open in the user's browser, can invoke arbitrary Java methods (such as Runtime.getRuntime().exec) to run arbitrary commands on the user's machine.

   Fix: Bind the HTTP server exclusively to 127.0.0.1 (new InetSocketAddress(InetAddress.getLoopbackAddress(), activePort)), remove the wildcard Access-Control-Allow-Origin header, and require a random per-session bearer token on all requests.

2. HighUnrestricted shell command and code execution MCP tools enabled by default

   packages/exoproc-mcp/src/server.ts:124

   The MCP server enables execute_command, execute_local_code, execute_code, and compile_c by default without any confirmation prompts or sandboxing. While their names and descriptions openly state that they run shell commands and Win32/TypeScript code, any prompt injection from untrusted files, web pages, or issues read by the AI agent can invoke these tools to execute arbitrary commands and native code on the host system.

   Fix: Disable arbitrary shell and local code execution tools by default behind an explicit CLI flag (such as --allow-exec), or restrict execution to an explicitly allowlisted set of target processes and commands.

3. HighCommand injection in spawn_process via automatic shell mode

   packages/exoproc-mcp/src/tools/process.ts:76

   The spawn_process tool is enabled by default to launch an executable binary. However, it checks if the command string contains shell metacharacters (|, &, >, <, ;) and automatically passes shell: true to child_process.spawn. An attacker who controls tool arguments via prompt injection can pass shell metacharacters to execute arbitrary shell commands even if execute_command is blocked by the client.

   Fix: Never enable shell: true in spawnProcess; require the executable path and argument array to be passed separately to child_process.spawn with shell: false.

4. HighArbitrary file overwrite and deletion via savePath in open_accessor and close_accessor

   packages/exoproc-mcp/src/tools/session.ts:136

   The open_accessor tool (enabled by default) accepts a caller-controlled savePath parameter and writes session JSON directly to that path without restriction. When close_accessor is later called, it deletes (unlinkSync) whatever file path was stored in s.sessionFile. Through prompt injection, an attacker can overwrite and then delete arbitrary files on the user's machine.

   Fix: Remove the arbitrary savePath parameter from the MCP tool or restrict session files to a dedicated directory using a sanitized filename.

5. HighUnrestricted shell, native code, and process manipulation tools enabled by default

   .agents/skills/exoproc/SKILL.md:100

   The MCP server openly provides tools that run arbitrary shell commands (execute_command), spawn executables (spawn_process), compile and inject x86_64 shellcode (compile_c, compile_shellcode), and execute arbitrary Win32 C code locally or inside any process (execute_local_code, execute_code). All of these tools are turned on by default. If an AI agent connected to Exoproc reads untrusted web pages, issues, or documents containing a prompt injection, a stranger can call these tools to run arbitrary commands and native code on the user's machine.

   Fix: Require explicit user confirmation for every destructive or code-executing tool call, provide a read-only inspection mode by default, and allow users to restrict attachment to an explicit allowlist of target process IDs or names.

6. HighUnrestricted shell and native code execution tools enabled by default

   .agents/skills/exoproc/SKILL.md:100

   The MCP server exposes tools such as execute_command, execute_local_code, execute_code, and spawn_process by default. Although these tools openly state their purpose, if the AI agent processes untrusted text containing a prompt injection, an attacker can instruct the agent to run arbitrary shell commands or native Win32 code on the user's machine.

   Fix: Disable shell and arbitrary code execution tools by default, require explicit user confirmation before each invocation, or restrict attachment to an allowlist of target processes.

7. HighUnrestricted shell, process, and native code execution tools enabled by default

   .agents/skills/exoproc/SKILL.md:100

   The MCP server openly provides 22 tools that are all turned on by default, including execute_command (runs any shell command), spawn_process (launches any executable), execute_local_code, execute_code, and write_memory. Furthermore, the skill file instructs the AI agent to use these tools directly. If the agent processes untrusted content containing a prompt injection (such as a malicious web page, issue, or strings inside a binary being reverse engineered), an attacker can run arbitrary commands or inject code into any process on the host machine.

   Fix: Disable high-risk tools like execute_command, execute_local_code, and spawn_process by default, require explicit per-invocation user confirmation in the MCP client, and allow restricting instrumentation to specific target PIDs or process names.

8. HighArbitrary Code Execution via Unsandboxed AsyncFunction Evaluation

   packages/java/runtime/src/runner/executor.ts:128

   The script executor compiles and runs caller-supplied TypeScript or JavaScript source strings directly inside the host Bun/Node process using AsyncFunction (equivalent to eval) with full access to native Win32 FFI bindings and the host runtime. This capability is used by the MCP server's code execution tools (execute_code and execute_local_code), which are enabled by default. If an AI agent is manipulated via prompt injection, an attacker can run arbitrary code on the user's machine.

   Fix: Disable arbitrary code execution tools by default or require explicit user confirmation before executing dynamic scripts.

9. HighUnrestricted command, code, and process execution tools enabled by default

   .agents/skills/exoproc/SKILL.md:100

   The Exoproc MCP server and its installed agent skill expose 22 tools that are all enabled by default, including arbitrary shell command execution (execute_command), process spawning (spawn_process), local Win32 code execution (execute_local_code), C-to-shellcode JIT compilation (compile_c), and remote process memory and thread manipulation (execute_code, nthread_call, minhook_install, write_memory). Although the project openly documents these capabilities, an AI agent that reads untrusted web pages, issues, or files can be tricked via prompt injection into invoking these tools to run arbitrary code or compromise processes on the host machine.

   Fix: Require explicit human-in-the-loop approval for every tool call in the MCP client, disable general-purpose shell and local code execution tools (execute_command, spawn_process, execute_local_code) by default, and restrict process instrumentation to a user-configured allowlist of target PIDs or executables.

10. MediumArbitrary file overwrite via outputPath in take_screenshot

    packages/exoproc-mcp/src/tools/desktop.ts:299

    The take_screenshot tool (enabled by default) accepts an outputPath (or savePath) argument and resolves it against the current working directory without restricting path traversal or file extensions, allowing a prompt injection attacker to overwrite arbitrary files on disk with PNG data.

    Fix: Restrict screenshot output paths to a designated output directory and enforce a .png extension.

11. MediumPath traversal (Zip Slip) and shell interpolation in dependency downloader

    packages/utils/src/downloader.ts:172

    In extractAllFromZip, archive entry paths are concatenated with destDir using join(destDir, entry.path) without verifying that the resolved path stays within destDir, allowing an archive with ../ sequences to write files outside the target directory. In addition, downloadFileSync and extractEntryFromZipSync interpolate URLs and file paths directly into execSync shell commands.

    Fix: Validate that resolve(destDir, entry.path) starts with resolve(destDir) + sep before extracting, and use execFileSync with argument arrays instead of execSync string interpolation.

12. MediumMinecraft protocol server binds to all network interfaces by default

    packages/minecraft/src/protocol/server.ts:23

    MinecraftServer defaults to binding to 0.0.0.0 on port 25565 rather than 127.0.0.1, exposing the test/analysis server to other machines on the local network when started without an explicit host option.

    Fix: Default the host option to '127.0.0.1' so the server is only reachable locally unless explicitly configured otherwise.

13. MediumUnpinned remote installation script piped directly to PowerShell

    README.md:18

    The documentation instructs users to install and update Exoproc by fetching a remote PowerShell script from exoproc.woldan.me and piping it directly into Invoke-Expression (iex) without version pinning or cryptographic checksum verification. If the domain or server is compromised, running this command will execute arbitrary code.

    Fix: Install from a pinned npm package version with integrity verification, or download the installer script to disk and verify its cryptographic hash before executing it.

14. MediumUnpinned remote PowerShell installation script piped directly to Invoke-Expression

    README.md:18

    The documentation instructs users to install and update Exoproc by fetching a script over HTTPS from exoproc.woldan.me and piping it directly into iex (Invoke-Expression) without version pinning or cryptographic hash verification. If the domain or hosting server is compromised, users running this command will execute arbitrary attacker-controlled PowerShell code.

    Fix: Recommend installing pinned versions from npm/bun with integrity verification, or provide a downloadable release artifact with a published SHA-256 checksum for users to verify before execution.

15. MediumUnpinned remote PowerShell installation script piped to Invoke-Expression

    README.md:18

    The installation instructions direct users to download and immediately execute a PowerShell script from exoproc.woldan.me using irm piped to iex without version pinning or cryptographic hash verification. If the domain or hosting server is compromised, users running this command will execute arbitrary code.

    Fix: Publish versioned release artifacts with SHA-256 checksums or instruct users to install directly from a pinned package registry version.

16. MediumPredictable Temporary DLL Path with Size-Only Integrity Check

    packages/capstone/core/src/def/index.ts:62

    When capstone.dll is not found in the local cache and on-demand download fails, findCapstoneDll extracts an embedded DLL to a fixed filename in the shared system temporary directory (exoproc_capstone.dll). It only checks whether an existing file has the same byte size (statSync(tempDllPath).size !== buf.length) before loading it into the process via FFI. A local attacker or another process with access to the temporary directory could pre-create or replace this file with a malicious DLL of the same size to achieve arbitrary native code execution.

    Fix: Write the extracted DLL to a user-private cache directory with restricted permissions and verify its SHA-256 cryptographic hash before loading it.

17. MediumUnpinned Remote Script Execution in PowerShell Installer

    apps/docs/public/install.ps1:27

    The public PowerShell installation script downloads and immediately executes the remote Bun installer script using Invoke-Expression without version pinning or checksum verification, and then installs exoproc@latest without pinning a version. If the remote script host or package registry is compromised, arbitrary code will execute during installation.

    Fix: Pin specific release versions and verify SHA-256 checksums of downloaded scripts and binaries before executing them.

18. LowUnpinned remote PowerShell install script piped to Invoke-Expression

    README.md:18

    The quick-start instructions advise users to install the tool by fetching https://exoproc.woldan.me/install.ps1 and piping it directly to iex (Invoke-Expression) without version pinning or checksum verification.

    Fix: Recommend installing via a package manager with integrity checks (such as bun add -g exoproc) or provide a pinned release artifact with a cryptographic hash.

19. LowPostinstall hook automatically downloads external binary dependencies

    package.json:62

    The monorepo package.json defines a postinstall script that automatically runs downloadAllWorkspaceDeps to fetch external binary dependencies during bun install. Although the root package is marked private and only runs for developers cloning the repository, automatic network downloads during install increase exposure to supply-chain issues.

    Fix: Remove the postinstall hook and have developers run bun run deps explicitly when setting up the workspace.

20. LowUnpinned remote PowerShell installation script

    README.md:18

    The documentation instructs users to install and update the tool by piping a remote script from exoproc.woldan.me directly into PowerShell (iex) without version pinning or cryptographic hash verification. If the domain or hosting server is compromised, users running this command would execute arbitrary code.

    Fix: Pin installation instructions to immutable release artifacts with checksum verification, or recommend installing directly from a versioned package registry.

21. LowAutomatic binary downloads during postinstall

    package.json:62

    The root monorepo package.json defines a postinstall lifecycle script that automatically runs 'bun run deps' to download external binary dependencies from the network when dependencies are installed.

    Fix: Avoid network downloads in automatic postinstall hooks or require explicit user opt-in via a dedicated setup command.

22. LowAutomatic binary download during monorepo postinstall

    package.json:62

    The root monorepo package.json defines a postinstall script that automatically invokes downloadAllWorkspaceDeps to fetch external binaries from the network during bun install. Because the root package is marked private, this only affects developers installing the repository from source rather than npm package consumers.

    Fix: Remove the postinstall hook and require developers to run bun run deps explicitly when setting up the workspace.

23. LowWeak SHA-1 Hash Verification for Downloaded Compiler JARs

    packages/java/jjit/deps.json:8

    The dependency configuration for the downloaded Eclipse Compiler for Java (ECJ) and Tiny-Remapper JARs only specifies SHA-1 hashes and omits SHA-256 hashes. Because SHA-1 is vulnerable to collision attacks, relying solely on SHA-1 to verify executable JARs downloaded during postinstall or runtime weakens supply-chain integrity.

    Fix: Add sha256 digests for all JAR dependencies in deps.json and require SHA-256 verification when downloading artifacts.

24. LowMonorepo postinstall script automatically downloads external binaries

    package.json:62

    The monorepo root package.json defines a postinstall script that runs bun run deps, which automatically downloads external binary dependencies (such as capstone.dll and Java compiler JARs) during bun install. While this root configuration only runs for developers who clone the repository and verifies checksums, performing network downloads automatically during package installation increases exposure to network or supply-chain failures.

    Fix: Remove bun run deps from the automatic postinstall lifecycle hook and instruct developers to run bun run deps manually when setting up the repository.

25. InfoAutomatic binary download in monorepo postinstall script

    package.json:62

    The root monorepo package.json defines a postinstall script that automatically invokes downloadAllWorkspaceDeps to fetch external binary dependencies from the network when bun install is run.

    Fix: Consider requiring developers to run bun run deps explicitly rather than triggering network downloads automatically during postinstall.