Symlink Following in markdownify-mcp

Compliance Impact

The vulnerability allows local attackers to bypass path allowlist checks via symlink manipulation, potentially granting unauthorized access to files outside intended directories.

Such unauthorized file access could lead to exposure of sensitive or protected data, which may impact compliance with data protection regulations like GDPR or HIPAA if the affected files contain personal or health information.

However, the vulnerability is limited to local attack vectors and requires local access, which may reduce the risk in some deployment scenarios.

No explicit information is provided about direct compliance impacts or regulatory considerations in the provided resources.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in markdownify-mcp up to version 1.1.0 involves a flaw in the function assertPathAllowed, which is responsible for checking if a file path is allowed. The issue arises because the path authorization relies on lexical path normalization and string comparison (using startsWith()) instead of canonicalizing paths with realpath. This allows an attacker to create symbolic links (symlinks) that point to files outside the allowed directory but appear to be inside it, bypassing the path allowlist.

As a result, the server follows these symlinks and grants unauthorized access to files outside the intended directory boundary. The attack can only be executed locally.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized file access outside the allowed directory in deployments where the allowed directory is writable or influenced by untrusted users. An attacker with local access can exploit symlink following to read files that should be restricted, potentially exposing sensitive information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves bypassing path allowlist checks via symlinked files, which can only be exploited locally. Detection involves identifying symlinks that point outside of allowed directories or checking for unauthorized file accesses through symlinks.

You can use commands to find symlinks within the allowed directories and verify if they point outside the intended boundaries. For example, on a Unix-like system, you can run:

• find /path/to/allowed/directory -type l -exec ls -l {} \;

This command lists all symbolic links and their targets inside the allowed directory. You should verify if any symlink points outside the allowed directory.

Additionally, monitoring local file access logs or using system auditing tools to detect unexpected file reads via symlinks may help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting local user permissions to prevent untrusted users from creating symlinks in the allowed directories.

Avoid allowing writable or user-influenced directories as allowed roots in the markdownify-mcp configuration.

Apply the fix from the pending pull request which canonicalizes paths using realpath and replaces prefix-based checks with path-relative boundary checks to prevent symlink escapes.

If upgrading is not immediately possible, consider monitoring and restricting local access to the vulnerable function or service.

Useful 0 Not Useful 0