TMA-MCP-5.4.1

Ensure path traversal and arbitrary filesystem access are prevented

ÉlevéeNiveau 1Automatiséemcp-server

Description

The server normalizes and canonicalizes every filesystem path supplied as a tool or resource parameter before any access-control check or filesystem operation. Canonicalization resolves symbolic links, for example os.path.realpath() in Python or fs.realpathSync() in Node.js, before comparing the resolved path against the configured allowlist of approved directories. Symlink bypass and ../ directory traversal are two independent attack paths, and each is guarded. The read is rejected unless the resolved real path is the approved root itself or a descendant of it, compared by path component and not by string prefix, so an approved root such as /srv/approved does not admit a sibling such as /srv/approved_evil. Every rejected attempt is logged as a security event. Without canonicalization, a ../ sequence or a symlink can resolve to a file outside the approved scope while passing a naive c...

Méthode de vérification

Méthode d'audit: Commande shell

shell

cfg="${MCP_CONFIG:-/etc/mcp/server.json}"; [ -f "$cfg" ] || { echo "missing $cfg (set MCP_CONFIG)"; exit 1; }; grep -Eq '"cis_5_4_1"|"protocolVersion"|"capabilities"|"auth"' "$cfg" && echo compliant || echo "non-compliant: section 5.4.1"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Configure the server's path-handling middleware to canonicalize every supplied path, resolving symlinks and ../ via realpath or realpathSync, before any access check. Reject the read unless the resolved real path is the approved root or a descendant of it, compared by path component rather than by string prefix, and log rejected attempts as security events. Set the approved directories in server configuration. For defense in depth, add kernel-enforced confinement that resolves beneath the root without following symlinks, and apply the OS-level isolation Recommendations in Section 9. This is server middleware, so there is no portable command for the canonicalization logic itself.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: access-controlaimcpmcp-server
Référence: CIS MCP Server Benchmark v1.0.0 - 5.4.1 Ensure path traversal and arbitrary filesystem access are prevented

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target mcp-server