-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fast-filesystem-mcp | npm | <= 3.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists due to improper path validation in the fast-filesystem-mcp package. The core of the issue lies in the isPathAllowed and safePath functions within src/utils.ts. These functions use path.resolve() to canonicalize file paths before checking if they are within an allowed directory. The critical flaw is that path.resolve() does not resolve symbolic links to their actual physical paths.
An attacker can exploit this by creating a symbolic link inside an allowed directory that points to a sensitive file or directory outside of the allowed locations (e.g., /etc/passwd). When a file operation tool like fast_read_file (implemented by handleReadFileWithAutoChunking) is called with the path to this symbolic link, the isPathAllowed function will approve it because the link's path appears to be in a safe location. Subsequently, the path is passed to native file system functions (like fs.open or fs.stat), which follow the symbolic link and access the restricted resource.
The functions handleReadFileWithAutoChunking, handleListDirectoryWithAutoChunking, and handleSearchFilesWithAutoChunking in src/enhanced-handlers.ts are all vulnerable because they consume user-provided paths and rely on the flawed safePath function for validation, making them entry points for exploitation.
isPathAllowedsrc/utils.ts
safePathsrc/utils.ts
handleReadFileWithAutoChunkingsrc/enhanced-handlers.ts
handleListDirectoryWithAutoChunkingsrc/enhanced-handlers.ts
handleSearchFilesWithAutoChunkingsrc/enhanced-handlers.ts