Attack Chain

1. An attacker influences an LLM agent to interact with the claude-faf-mcp server by hosting malicious content in a project file, ticket, or web page.
2. The LLM agent receives the content, triggering a malicious tool call to faf_read or faf_write via the MCP interface.
3. The attacker-controlled tool call includes a crafted path argument, such as /home/user/.ssh/id_rsa or ../../../../etc/passwd.
4. The server's getProjectPath() function receives the path and processes it using path.resolve() without checking against a restricted project root.
5. The server executes the filesystem operation on the target path, as it assumes the request is within the legitimate .faf project context.
6. For faf_read, the server returns the contents of the unauthorized sensitive file to the LLM agent, where the attacker can then exfiltrate it.
7. For faf_write, the server overwrites or creates arbitrary files on the local disk using the permissions of the user running the MCP server.

Impact

Successful exploitation results in arbitrary local file disclosure and unauthorized file modification. An attacker can access critical secrets, API keys, and environment variables stored on the host system. Furthermore, the ability to write files allows for potential persistence or lateral movement by overwriting configuration files or adding malicious scripts to accessible directories. The impact affects any developer or system running a vulnerable version of claude-faf-mcp in an environment where the agent processes untrusted, attacker-controlled data.

Recommendation

• Upgrade claude-faf-mcp to version 5.7.2 or later immediately to apply the path confinement logic in safe-path.ts.
• If upgrading is delayed, configure the FAF_ALLOWED_ROOTS environment variable to restrict the server to a single, hardened project directory.
• Audit logs for unauthorized tool execution patterns or suspicious file paths (e.g., directory traversal strings ../ or common secret paths) passed to the MCP server.
• Ensure the MCP server process runs with the least privilege necessary, avoiding execution as a root or high-privilege user to minimize the impact of file system writes.