GHSA-rr55-jp92-8wp2: claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Tool calls in claude-faf-mcp hand a caller-chosen path to the filesystem after ~ expansion and path.resolve(). The getProjectPath() helper behind the .faf tools, and the faf_read and faf_write tools, relied on a denylist. A full path to a home-directory file still went through.

Because this server is built to sit next to Claude, the likely attacker is text the model reads, not a person at a keyboard: a web page, README, ticket or .faf file that tells the agent to call faf_read on ~/.aws/credentials and repeat the output. faf_write gives the same attacker a way to drop or overwrite files outside the project, within what the user account may write. The server uses stdio, so no port is exposed, but any content the agent ingests can trigger the call.

The maintainers found it while auditing their other servers after the report on grok-faf-mcp (GHSA-cc2g-gq8c-r332). The same fix landed in faf-mcp (GHSA-j4r7-8ph4-43g3).

npm package claude-faf-mcp, versions <= 5.7.1. This includes copies installed through the one-click .mcpb bundle. Check a global install with:

npm ls -g claude-faf-mcp

For an .mcpb install, read the version in your MCP client's extension list.

Upgrade to 5.7.2, or reinstall the .mcpb bundle:

npm install -g [email protected]

Version 5.7.2 adds safe-path.ts. It limits reads to .faf and .fafm files, keeps faf_read and faf_write inside the working directory and system temp, resolves symlinks, rejects absolute paths and ../, and adds a PATH-DENIED check in callTool().

Before you upgrade, use the server only on projects you trust. After you upgrade, FAF_ALLOWED_ROOTS can narrow access to a single directory.

In Claude or other client transcripts, search for faf_read, faf_write and .faf tool calls whose path points outside the project: ~, absolute paths, .., .ssh, .aws, .env. Check for unexpected recent writes to dotfiles in the home directory. On 5.7.2 and later, rejected attempts show a PATH-DENIED message. Beam records agent MCP tool calls and file access, and can flag reads of credential files.

Summary

claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it (~ expansion + path.resolve()) straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to read — and, via the file tools, write — files outside the intended .faf project context. The only remaining limit is OS file permissions.

Affected tools

The shared getProjectPath() chokepoint (feeding the .faf tools) and the general-purpose faf_read / faf_write file tools resolved a caller path straight into a read/write with no confinement (denylist-only); an absolute path still reached home-directory secrets, and faf_write could write outside the project.

Impact

An MCP client — or an LLM prompt-injected via attacker-controlled content (a web page, README, ticket, or .faf) into issuing a tool call — can read any file the server process can read: SSH keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), .env files, source, /etc/passwd; and faf_write could write outside the project. This is a sensitive-information-disclosure (CWE-200) primitive that far exceeds the declared .faf project-context scope. The server runs over stdio, so the read/write is reached by a crafted tool call (e.g. a prompt-injected agent processing attacker-controlled content).

Patches

Fixed in 5.7.2 by confining every caller-supplied path before any filesystem access (safe-path.ts):

• Reads are restricted to .faf / .fafm context files, so non-context files (secrets) are refused regardless of directory.
• General file ops (faf_read / faf_write) are confined to the project root (cwd + system temp; override with FAF_ALLOWED_ROOTS).
• Paths are canonicalized through symlinks (closing the symlink bypass); absolute paths and ../ escapes are rejected; callTool() gains a central PATH-DENIED guard.

Upgrade: npm install -g [email protected] (or one-click .mcpb install).

Workarounds

If you cannot upgrade immediately, run the server only against trusted local projects, and set FAF_ALLOWED_ROOTS (patched versions) to a single project directory for a hard directory boundary.

Credits

Identified by the maintainers during a sibling-server audit prompted by the coordinated disclosure of the same class of issue in grok-faf-mcp by Zhihao Zhang (Worcester Polytechnic Institute).