GHSA-cc2g-gq8c-r332: grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Several tools take a caller-supplied path, expand ~, run path.resolve() and read the result. An absolute path or a ../ traversal goes through as-is. The affected tools are refresh_faf, faf_score, faf_get_orchestration_policy and refresh_blend, which share a getProjectPath() helper. The general faf_read and faf_write tools only used a denylist, so an absolute path still reached home-directory secrets, and faf_write could write outside the project.

The server talks over stdio, so the attacker does not connect to it directly. They reach it through the MCP client or through the model. A web page, README, ticket or .faf file with injected instructions can make an agent call the tool with a path like ~/.ssh/id_rsa or ~/.aws/credentials. refresh_faf returns the file contents verbatim as "fresh DNA". faf_get_orchestration_policy echoes the resolved absolute path, which confirms the read.

The only limit is OS file permissions on the user running the server. Expect SSH keys, cloud credentials, .env files and source to be readable.

npm package grok-faf-mcp, all versions <= 1.5.2. Any MCP client configured to launch the server is exposed, including when you run it with bunx grok-faf-mcp. Check the installed version:

npm ls -g grok-faf-mcp

If you start it with bunx, check which version your MCP config pins or resolves.

Upgrade to 1.5.3:

npm install -g [email protected]

The fix adds safe-path.ts. Reads are limited to .faf and .fafm context files. faf_read and faf_write are confined to the project root plus the system temp directory. Paths are canonicalized through symlinks, and absolute paths and ../ escapes are rejected.

If you cannot upgrade, run the server only against trusted local projects. On patched versions, set FAF_ALLOWED_ROOTS to a single project directory for a hard boundary.

Review your MCP client logs for refresh_faf, faf_score, faf_get_orchestration_policy, refresh_blend or faf_read calls whose path is absolute, starts with ~, or contains ../, especially paths into .ssh, .aws, .env or /etc/passwd. Check for faf_write calls that targeted files outside the project. If any appear, rotate the credentials that were readable. Beam records agent MCP tool calls and file access, so its rules can flag these reads.

Summary

Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read files outside the intended .faf project context. The only remaining limit is OS file permissions.

Affected tools

refresh_faf, faf_score, faf_get_orchestration_policy, refresh_blend (and the shared getProjectPath() chokepoint feeding the .faf tools), plus the general-purpose faf_read / faf_write file tools (denylist-only; an absolute path still reached home-directory secrets, and faf_write could write outside the project). refresh_faf echoes the file contents verbatim back to the caller as "fresh DNA"; faf_get_orchestration_policy reflects values parsed out of the attacker-chosen file and echoes the resolved absolute path — confirming the read.

Impact

An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).

Patches

Fixed in 1.5.3 by confining every caller-supplied path before any filesystem access (safe-path.ts):

• Reads are restricted to .faf / .fafm context files, so non-context files (secrets) are refused regardless of directory.
• General file ops (faf_read / faf_write) are confined to the project root (cwd + system temp; override with FAF_ALLOWED_ROOTS).
• Paths are canonicalized through symlinks (closing the symlink bypass); absolute paths and ../ escapes are rejected.

Upgrade: npm install -g [email protected] (or bunx grok-faf-mcp).

Workarounds

If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.

Credits

Discovered and responsibly reported via coordinated disclosure by Zhihao Zhang (Worcester Polytechnic Institute).