CVE-2025-68145

Executive Summary

CVE-2025-68145 is a path traversal vulnerability in mcp-server-git, a server that exposes Git operations via the Model Context Protocol (MCP). The vulnerability exists in versions prior to 2025.12.17. When the server is started with the --repository flag to restrict operations to a specific repository path, it fails to validate that repo_path arguments in subsequent tool calls are actually within that configured path. This allows an attacker to perform Git operations on arbitrary repositories accessible to the server process, bypassing the intended access control.

The vulnerability has a CVSS score of 0.0 (pending official scoring), but based on the description, it is a medium-severity issue with low impact on confidentiality and integrity. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the mcp-server-git package, which is distributed via npm (Node Package Manager). Users should verify their dependency tree and ensure they are using version 2025.12.17 or later. The package is used in MCP-based applications and may be included as a dependency in larger projects. Supply chain risk is moderate, as the vulnerability allows unauthorized access to Git repositories on the server.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply sends a crafted repo_path argument.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): Low (L) – Limited access to repository contents.
• Integrity (I): Low (L) – Limited ability to modify repository data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 5.3)

Deep Dive & Mechanics

The mcp-server-git server is designed to expose Git operations (e.g., git log, git diff, git status) via MCP tools. When started with the --repository flag, it is supposed to restrict all operations to that specific repository path. However, the vulnerability lies in the lack of path validation for the repo_path argument passed to tool calls.

Root Cause: The server does not resolve and compare the configured repository path with the requested repo_path. An attacker can provide a path like ../../other-repo or a symlink to a different repository, and the server will execute Git operations on that path without checking if it is within the allowed directory.

Attack Scenario:

1. The server is started with --repository /var/git/allowed-repo.
2. An attacker sends a tool call with repo_path: "/var/git/other-repo" or repo_path: "/var/git/allowed-repo/../../other-repo".
3. The server executes the Git command on the attacker-specified path, bypassing the intended restriction.

Impact: An attacker can read, write, or execute Git operations on any repository accessible to the server process, potentially leaking sensitive data or corrupting repositories.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// No path validation
function handleToolCall(tool, args) {
  const repoPath = args.repo_path;
  // Directly uses repoPath without checking if it's within allowed repository
  const result = execGitCommand(tool, repoPath);
  return result;
}

Patched Code (simplified):

const path = require('path');
const fs = require('fs');

function isPathWithinAllowed(repoPath, allowedRepo) {
  const resolvedRepo = fs.realpathSync(allowedRepo);
  const resolvedPath = fs.realpathSync(repoPath);
  return resolvedPath.startsWith(resolvedRepo);
}

function handleToolCall(tool, args) {
  const repoPath = args.repo_path;
  if (!isPathWithinAllowed(repoPath, configuredRepo)) {
    throw new Error('Access denied: repository path is not within allowed repository');
  }
  const result = execGitCommand(tool, repoPath);
  return result;
}

The fix uses fs.realpathSync to resolve symlinks and then checks if the requested path starts with the allowed repository path.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an mcp-server-git instance running a vulnerable version (< 2025.12.17) with the --repository flag set.
• Ability to send MCP tool calls to the server.

Exploitation Steps:

1. Identify the configured repository path (e.g., by observing error messages or documentation).
2. Craft a tool call with a repo_path argument that points to a different repository, such as:
   • Absolute path: /var/git/other-repo
   • Relative path: ../other-repo
   • Symlink: /var/git/allowed-repo/link-to-other-repo
3. Send the tool call to the server.
4. The server will execute the Git operation on the attacker-specified path.

Example Payload:

{
  "tool": "git_log",
  "args": {
    "repo_path": "/var/git/other-repo",
    "max_count": 10
  }
}

Blue Team

Detection:

• Monitor for tool calls with repo_path arguments that do not match the expected repository path.
• Look for path traversal patterns (e.g., ../, ..\\, absolute paths outside the allowed directory).
• Check server logs for errors related to path validation failures (after patching).

Hunting:

• Search for mcp-server-git instances in your environment.
• Review server configurations to ensure the --repository flag is used correctly.
• Verify that all instances are running version 2025.12.17 or later.

Indicators of Compromise (IOCs)

• Network: MCP tool calls with repo_path containing path traversal sequences or absolute paths outside the allowed repository.
• File System: Unexpected Git operations on repositories not intended to be exposed.
• Logs: Server logs showing tool calls with suspicious repo_path values.
• Process: mcp-server-git process running with elevated privileges or accessing unexpected directories.

Detection Engineering

YARA Rule

rule CVE_2025_68145_MCP_Server_Git_Path_Traversal {
  meta:
    description = "Detects path traversal attempts in mcp-server-git tool calls"
    author = "Valters IT"
    date = "2025-04-10"
    cve = "CVE-2025-68145"
  strings:
    $repo_path = /"repo_path"\s*:\s*"[^"]*\.\.\/[^"]*"/ nocase
    $abs_path = /"repo_path"\s*:\s*"\/[^"]*"/ nocase
  condition:
    any of them
}

Sigma Rule

title: CVE-2025-68145 - MCP Server Git Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in mcp-server-git tool calls
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: mcp-server-git
detection:
  selection:
    tool: "git_*"
    args.repo_path|contains: 
      - ".."
      - "/"
  condition: selection
falsepositives:
  - Legitimate use of absolute paths (if allowed by configuration)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-68145 - MCP Server Git Path Traversal"; flow:to_server,established; content:"repo_path"; nocase; pcre:"/repo_path\s*:\s*"[^"]*\.\.\/[^"]*"/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade mcp-server-git to version 2025.12.17 or later.
2. If immediate upgrade is not possible, restrict network access to the server to trusted hosts only.
3. Monitor server logs for suspicious tool calls.

Long-term Mitigations:

• Implement additional access controls at the network level (e.g., firewall rules).
• Use a reverse proxy to validate and sanitize incoming requests.
• Regularly audit dependencies for known vulnerabilities.

Patch Details:

• Upgrade to version 2025.12.17.
• The fix adds path validation using fs.realpathSync to resolve symlinks and verify the requested path is within the allowed repository.

Report generated by Valters IT DevSecOps & CTI Expert System