| tiêu đề | wonderwhy-er DesktopCommanderMCP 0.2.13 wonderwhy-er |
|---|
| Mô tả | Directory Traversal via Symbolic Link Bypass Leading to Arbitrary Read/Write
The isPathAllowed function for validating file operations is vulnerable to a security bypass using symbolic links (symlinks). The function does a good job of validating traditional directory traversal attacks (e.g., ../../../) by normalising the path. It validates that a path string starts with an allowed directory, but it does not resolve symlinks. An attacker can create a symlink inside an allowed directory that points to a restricted location. The check will pass, but the subsequent file operation will follow the symlink, leading to an arbitrary file read/write.
This vulnerability completely bypasses the directory restrictions, allowing an attacker to read or write arbitrary files on the system with the permissions of the running process. This can lead to sensitive data exposure (e.g., SSH keys, configuration files) or code execution if an attacker can write to executable files. The severity would vary depending on the privileges of the user running the server. |
|---|
| Nguồn | ⚠️ https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219 |
|---|
| Người dùng | crem (UID 91252) |
|---|
| Đệ trình | 03/10/2025 07:15 (cách đây 10 các tháng) |
|---|
| Kiểm duyệt | 08/10/2025 12:41 (5 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 327606 [wonderwhy-er DesktopCommanderMCP đến 0.2.13 src/tools/filesystem.ts isPathAllowed nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|