{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grok-faf-mcp--1.5.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["grok-faf-mcp (\u003c= 1.5.2)"],"_cs_severities":["high"],"_cs_tags":["mcp","path-traversal","information-disclosure"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003egrok-faf-mcp\u003c/code\u003e package, a Model Context Protocol (MCP) server, contains an arbitrary local file read vulnerability in versions 1.5.2 and earlier. The flaw resides in several tools, including \u003ccode\u003erefresh_faf\u003c/code\u003e, \u003ccode\u003efaf_score\u003c/code\u003e, and \u003ccode\u003efaf_read\u003c/code\u003e, which resolve caller-supplied \u003ccode\u003epath\u003c/code\u003e arguments without strictly confining them to a designated project directory. By leveraging absolute paths or directory traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e), a remote attacker - or an LLM agent subject to prompt injection - can escape the intended project context and read any file accessible to the server process. This poses a severe risk of credential theft, including SSH keys, cloud provider configuration files, and environment variables. The vulnerability was disclosed by Zhihao Zhang and addressed in version 1.5.3, which introduces path canonicalization and restricted access to defined project directories.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker influences an LLM agent to interact with the vulnerable \u003ccode\u003egrok-faf-mcp\u003c/code\u003e server.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers a prompt injection payload containing a malicious file path argument (e.g., \u003ccode\u003e../../../../../../etc/passwd\u003c/code\u003e or \u003ccode\u003e../../.ssh/id_rsa\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe MCP server receives the tool call (e.g., \u003ccode\u003efaf_read\u003c/code\u003e) from the LLM client via stdio.\u003c/li\u003e\n\u003cli\u003eThe internal \u003ccode\u003egetProjectPath()\u003c/code\u003e function fails to restrict the path, resolving the attacker-provided traversal to the filesystem root.\u003c/li\u003e\n\u003cli\u003eThe server process opens the requested sensitive file based on the OS-level permissions of the user running the MCP process.\u003c/li\u003e\n\u003cli\u003eThe server tool, such as \u003ccode\u003erefresh_faf\u003c/code\u003e or \u003ccode\u003efaf_read\u003c/code\u003e, transmits the contents of the target file back to the LLM agent as part of its response.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates the sensitive data from the agent's output.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized disclosure of sensitive host information, including SSH private keys, cloud service credentials, environment files, and system configuration data. This primitive can lead to full host compromise if the server process is executed with high-privilege credentials or if the disclosed information provides access to further infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003egrok-faf-mcp\u003c/code\u003e to version 1.5.3 or higher via \u003ccode\u003enpm install -g grok-faf-mcp@1.5.3\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, restrict the server execution environment by setting the \u003ccode\u003eFAF_ALLOWED_ROOTS\u003c/code\u003e environment variable to a single, hardened project directory to enforce a strict boundary.\u003c/li\u003e\n\u003cli\u003eAudit MCP server logs for unexpected file path arguments that contain traversal patterns (\u003ccode\u003e../\u003c/code\u003e) or point to sensitive system directories.\u003c/li\u003e\n\u003cli\u003eAudit the runtime permissions of the user account executing the MCP server process to ensure the principle of least privilege is applied, specifically limiting access to sensitive user directories like \u003ccode\u003e.ssh\u003c/code\u003e or \u003ccode\u003e.aws\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:34:50Z","date_published":"2026-08-19T22:34:50Z","id":"https://feed.craftedsignal.io/briefs/2026-08-grok-faf-mcp-traversal/","summary":"The grok-faf-mcp MCP server contains an arbitrary file read vulnerability via inadequate path validation, allowing attackers to access sensitive host files by injecting path traversal sequences into tool arguments.","title":"Path Traversal Vulnerability in grok-faf-mcp","url":"https://feed.craftedsignal.io/briefs/2026-08-grok-faf-mcp-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Grok-Faf-Mcp (\u003c= 1.5.2)","version":"https://jsonfeed.org/version/1.1"}