GHSA-j4r7-8ph4-43g3: faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

The shared getProjectPath() helper, which feeds the .faf tools, and the faf_read and faf_write tools expand ~, call path.resolve() and act on the result. Their only guard was a denylist. Absolute paths and ../ sequences are not rejected, so a path into the home directory works.

The server uses stdio, so exploitation happens through a tool call. The caller can be a hostile MCP client or, more likely, a model that read injected instructions in a web page, README, ticket or .faf file. That model can be told to read ~/.ssh/id_rsa, ~/.aws/credentials or a project .env and return the content. It can also be told to use faf_write to put a file outside the project, for example in a shell startup file or an SSH authorized_keys file, if the user account can write there.

This is a sibling of the grok-faf-mcp bug (GHSA-cc2g-gq8c-r332). The maintainers found it in a follow-up audit of their other servers. The CVSS vector rates confidentiality only, but the advisory states the write path as well.

npm package faf-mcp, all versions <= 2.1.2. Anything that launches the server for an MCP client is exposed, whether installed globally or run with npx faf-mcp. Check the version:

npm ls -g faf-mcp

For npx setups, look at the version your MCP client config pins, or run npx faf-mcp --version if your build supports it.

Upgrade to 2.1.3:

npm install -g [email protected]

The patch adds safe-path.ts. Reads are limited to .faf and .fafm files. faf_read and faf_write stay inside the project root and system temp. Symlinks are resolved before the check. callTool() also gets a central PATH-DENIED guard.

Workaround if you cannot upgrade: use the server only on trusted local projects. Once on a patched version, FAF_ALLOWED_ROOTS can pin it to one directory.

Search MCP client or agent transcripts for faf_read, faf_write or .faf tool calls with a path that is absolute, begins with ~ or includes ../. Pay most attention to .ssh, .aws, .env, /etc and shell rc files. After upgrading, a blocked call returns a PATH-DENIED error, which also shows attempts. Check file modification times in sensitive directories for writes you did not expect. Beam logs agent file access and MCP tool calls, which gives you this trail.

Summary

faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read — and, via the file tools, write — files outside the intended .faf project context. The only remaining limit is OS file permissions.

Affected tools

The shared getProjectPath() chokepoint (feeding the .faf tools) and the general-purpose faf_read / faf_write file tools resolved a caller path straight into a read/write with no confinement (denylist-only); an absolute path still reached home-directory secrets, and faf_write could write outside the project.

Impact

An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd; and faf_write could write outside the project. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read/write is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).

Patches

Fixed in 2.1.3 by confining every caller-supplied path before any filesystem access (safe-path.ts):

• Reads are restricted to .faf / .fafm context files, so non-context files (secrets) are refused regardless of directory.
• General file ops (faf_read / faf_write) are confined to the project root (cwd + system temp; override with FAF_ALLOWED_ROOTS).
• Paths are canonicalized through symlinks (closing the symlink bypass); absolute paths and ../ escapes are rejected; callTool() gains a central PATH-DENIED guard.

Upgrade: npm install -g [email protected] (or npx faf-mcp).

Workarounds

If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.

Credits

Identified by the maintainers during a sibling-server audit prompted by the coordinated disclosure of the same class of issue in grok-faf-mcp by Zhihao Zhang (Worcester Polytechnic Institute).