{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/claude-faf-mcp--5.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["claude-faf-mcp (\u003c= 5.7.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","mcp","path-traversal","arbitrary-file-read","arbitrary-file-write"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003eclaude-faf-mcp\u003c/code\u003e package (versions 5.7.1 and earlier) contains a critical path traversal vulnerability in its Model Context Protocol (MCP) tools. The server process fails to confine user-supplied \u003ccode\u003epath\u003c/code\u003e arguments to a trusted project directory, instead resolving paths directly into the local filesystem. By providing absolute paths or directory traversal sequences like \u003ccode\u003e../\u003c/code\u003e, an attacker or a prompt-injected LLM can bypass intended project restrictions to read or write files anywhere the server process has operating system permissions. This vulnerability, identified during a security audit, permits unauthorized access to sensitive local credentials, including SSH keys, cloud configuration files (e.g., \u003ccode\u003e~/.aws/credentials\u003c/code\u003e), and \u003ccode\u003e.env\u003c/code\u003e files. The issue was remediated in version 5.7.2 by implementing strict path canonicalization and directory confinement guards in \u003ccode\u003esafe-path.ts\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker influences an LLM agent to interact with the \u003ccode\u003eclaude-faf-mcp\u003c/code\u003e server by hosting malicious content in a project file, ticket, or web page.\u003c/li\u003e\n\u003cli\u003eThe LLM agent receives the content, triggering a malicious tool call to \u003ccode\u003efaf_read\u003c/code\u003e or \u003ccode\u003efaf_write\u003c/code\u003e via the MCP interface.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled tool call includes a crafted \u003ccode\u003epath\u003c/code\u003e argument, such as \u003ccode\u003e/home/user/.ssh/id_rsa\u003c/code\u003e or \u003ccode\u003e../../../../etc/passwd\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server's \u003ccode\u003egetProjectPath()\u003c/code\u003e function receives the path and processes it using \u003ccode\u003epath.resolve()\u003c/code\u003e without checking against a restricted project root.\u003c/li\u003e\n\u003cli\u003eThe server executes the filesystem operation on the target path, as it assumes the request is within the legitimate \u003ccode\u003e.faf\u003c/code\u003e project context.\u003c/li\u003e\n\u003cli\u003eFor \u003ccode\u003efaf_read\u003c/code\u003e, the server returns the contents of the unauthorized sensitive file to the LLM agent, where the attacker can then exfiltrate it.\u003c/li\u003e\n\u003cli\u003eFor \u003ccode\u003efaf_write\u003c/code\u003e, the server overwrites or creates arbitrary files on the local disk using the permissions of the user running the MCP server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary local file disclosure and unauthorized file modification. An attacker can access critical secrets, API keys, and environment variables stored on the host system. Furthermore, the ability to write files allows for potential persistence or lateral movement by overwriting configuration files or adding malicious scripts to accessible directories. The impact affects any developer or system running a vulnerable version of \u003ccode\u003eclaude-faf-mcp\u003c/code\u003e in an environment where the agent processes untrusted, attacker-controlled data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eclaude-faf-mcp\u003c/code\u003e to version 5.7.2 or later immediately to apply the path confinement logic in \u003ccode\u003esafe-path.ts\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf upgrading is delayed, configure the \u003ccode\u003eFAF_ALLOWED_ROOTS\u003c/code\u003e environment variable to restrict the server to a single, hardened project directory.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized tool execution patterns or suspicious file paths (e.g., directory traversal strings \u003ccode\u003e../\u003c/code\u003e or common secret paths) passed to the MCP server.\u003c/li\u003e\n\u003cli\u003eEnsure the MCP server process runs with the least privilege necessary, avoiding execution as a root or high-privilege user to minimize the impact of file system writes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:34:36Z","date_published":"2026-08-19T22:34:36Z","id":"https://feed.craftedsignal.io/briefs/2026-08-claude-faf-mcp/","summary":"The claude-faf-mcp MCP server exposes arbitrary file read and write primitives through unconfined path parameters, allowing LLM-based prompt injection to access sensitive local files or modify system files.","title":"Arbitrary Local File Read and Write in claude-faf-mcp","url":"https://feed.craftedsignal.io/briefs/2026-08-claude-faf-mcp/"}],"language":"en","title":"CraftedSignal Threat Feed - Claude-Faf-Mcp (\u003c= 5.7.1)","version":"https://jsonfeed.org/version/1.1"}