Arbitrary Local File Read and Write in faf-mcp

The faf-mcp package (versions 2.1.2 and earlier) contains a critical path traversal vulnerability caused by the insecure handling of the path argument in its MCP (Model Context Protocol) tools. The application resolves caller-provided paths using ~ expansion and path.resolve() without confining them to a trusted project directory. This flaw allows an attacker to bypass intended directory restrictions using absolute paths or directory traversal sequences (../). By sending crafted tool calls via an MCP client, an attacker can read sensitive files, such as SSH keys, AWS credentials, or system configuration files, and overwrite files on the host system where the faf-mcp server process has sufficient permissions. This vulnerability was identified during a security audit and is remediated in version 2.1.3 through robust path canonicalization and directory confinement.

Impact

Successful exploitation allows an attacker to perform unauthorized file system operations, leading to potential credential theft, information disclosure, and system compromise. Attackers can reach critical files such as ~/.ssh/id_rsa, ~/.aws/credentials, and /etc/passwd. Because the server operates over stdio and responds to tool calls, this vulnerability is highly susceptible to exploitation through LLM prompt injection, where an agent processing malicious external content is coerced into executing these unauthorized file operations.

Recommendation

• Upgrade to faf-mcp version 2.1.3 or later immediately to apply the path confinement logic in safe-path.ts.
• If upgrading is not immediately feasible, restrict the use of the server to trusted environments and define the FAF_ALLOWED_ROOTS environment variable to explicitly bound access to a single, low-risk project directory.
• Implement endpoint monitoring to detect unauthorized file access patterns from the faf-mcp process (or the parent node process) targeting sensitive configuration paths outside the expected working directory.