Path Traversal in filesystem-mcp-server

Executive Summary

This vulnerability exists in the geekgod382 filesystem-mcp-server version 1.0.0, specifically in the is_path_allowed function within the server.py file of the read_file_tool/write_file_tool component.

The issue allows an attacker to perform a path traversal attack, which means they can manipulate file paths to access files and directories outside the intended scope.

The attack can be launched remotely without any authentication, making it easier for attackers to exploit.

Upgrading to version 1.1.0 of the software addresses this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing whether the filesystem-mcp-server improperly allows access to paths that share a prefix with allowed directories but are actually outside those directories. Specifically, you can attempt to access or manipulate files using crafted paths that exploit the prefix-check bypass in the is_path_allowed function.

For example, if the server's ALLOWED_PATHS includes /home/alice, you can try to read, write, or delete files in /home/alice_backup or other similarly prefixed directories to see if the server improperly permits these operations.

Suggested commands to test this behavior might include sending requests to the server's read_file_tool or write_file_tool with paths like /home/alice_backup/test.txt and observing if the operation succeeds.

Since the server is Python-based and uses an API for file operations, you can use curl or similar HTTP clients to send crafted requests. For example:

• curl -X POST http://<server_address>/write_file_tool -d '{"path": "/home/alice_backup/test.txt", "content": "test"}'
• curl -X POST http://<server_address>/read_file_tool -d '{"path": "/home/alice_backup/test.txt"}'

If these commands succeed in accessing or modifying files outside the intended allowed paths, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to access unauthorized files on the server by exploiting the path traversal flaw.

Such unauthorized access can lead to exposure of sensitive information, data leakage, or modification of files.

Since the attack can be performed remotely without authentication, it increases the risk of compromise.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the filesystem-mcp-server allows an attacker to bypass path restrictions and perform unauthorized file operations such as reading, writing, or deleting files outside the intended allowed directories.

This unauthorized access to files can lead to exposure or modification of sensitive data, which poses significant risks to confidentiality and integrity.

Such risks can directly impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Failure to prevent unauthorized data access or modification could result in violations of these regulations, potentially leading to legal penalties, reputational damage, and loss of trust.

Therefore, this vulnerability undermines the ability of organizations using the affected software to maintain compliance with common security and privacy standards.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the affected component, geekgod382 filesystem-mcp-server, from version 1.0.0 to version 1.1.0.

This upgrade includes a patch (commit 45364545fc60dc80aadcd4379f08042d3d3d292e) that addresses the path traversal issue in the is_path_allowed function of server.py.

Useful 0 Not Useful 0