simpletool-server Path Traversal in `delete_shared_prompt`

[wing3e]

simpletool-server Path Traversal in delete_shared_prompt

1) CNA / Submission Type

• Submission type: Report a vulnerability (CVE ID request)
• Reporter role: Independent security researcher
• Report date: April 10, 2026

2) Reporter Contact (fill before submit)

• Reporter name: Winegee
• Reporter email: Winegee@zju.edu.cn
• Permission to share contact with vendor: Yes

3) Vendor / Product Identification

• Vendor: getsimpletool
• Product: simpletool-server
• Repository: https://github.com/getsimpletool/simpletool-server.git
• Reviewed local source path: python-batch-04/datasets/getsimpletool-simpletool-server
• Confirmed affected function: delete_shared_prompt
• Reviewed source file: src/mcpo_simple_server/services/prompt_manager/base_manager.py

4) Vulnerability Type

• CWE: CWE-73 (External Control of File Name or Path)
• Short title: The delete_shared_prompt flow uses attacker-controlled detail to access files through if os.path.exists(file_path): without a containment check.

5) Affected Versions

• Confirmed affected: 035efb1c98076ca3febd5e1f5fc3960f81a16af8
• Suspected affected range: revisions containing the same request-to-sink flow documented below
• Fixed version: Not available at time of report (April 10, 2026)

6) Vulnerability Description

simpletool-server exposes delete_shared_prompt and uses attacker-controlled detail in a filesystem-sensitive path.
In the reviewed code path, the sink executes if os.path.exists(file_path): without a canonicalization-and-boundary check.
As a result, traversal segments such as ../ or absolute-path style input can escape the intended working directory or output root. The delete_shared_prompt flow uses attacker-controlled detail to access files through if os.path.exists(file_path): without a containment check.

7) Technical Root Cause

1. Sink in src/mcpo_simple_server/services/prompt_manager/base_manager.py:443
   • Containing function: delete_shared_prompt
   • Sink code: if os.path.exists(file_path):
   • Source location emitted by SARIF: src/mcpo_simple_server/routers/prompts/prompt_handlers.py:235
2. Sink in src/mcpo_simple_server/services/prompt_manager/base_manager.py:445
   • Containing function: delete_shared_prompt
   • Sink code: os.remove(file_path)
   • Source location emitted by SARIF: src/mcpo_simple_server/routers/prompts/prompt_handlers.py:235
3. Audit conclusion
   • The delete_shared_prompt flow uses attacker-controlled detail to access files through if os.path.exists(file_path): without a containment check.

8) Attack Prerequisites

• The attacker can invoke delete_shared_prompt or reach the same request path through an exposed agent/client workflow.
• The server accepts attacker-controlled detail without a stricter validation layer in front of the confirmed sink.
• The executing process has the network or filesystem privileges needed to make the sink security-relevant.

9) Proof of Concept / Reproduction Guidance

• The minimal triggering payload is shown below. If the handler expects additional ordinary fields, supply any valid values accepted by the application.

1. Reproduction input

Set `detail` to `../../../../tmp/codex_poc.txt` and invoke `delete_shared_prompt`.

2. Expected result

• The server accepts attacker-controlled detail and reaches the sink at src/mcpo_simple_server/services/prompt_manager/base_manager.py:443.
• Observable unsafe behavior should match the confirmed issue type for this report (Path Traversal / Arbitrary File Access).

10) Security Impact

• Confidentiality: High when attacker-controlled paths can expose sensitive local files.
• Integrity: High when attacker-controlled paths can overwrite, create, or delete files.
• Availability: Medium to High depending on whether critical files or working directories are affected.
• Scope: Unchanged.

11) CVSS v3.1 Suggestion

• Suggested vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Suggested base score: 9.8 (Critical) when arbitrary file read/write/delete is reachable via the exposed tool.

12) Workarounds / Mitigations

• Restrict filesystem operations to a fixed allowlisted root directory.
• Resolve and canonicalize attacker-controlled paths before use, then enforce root-boundary checks.
• Reject traversal tokens, absolute paths, and symlink escapes where not explicitly required.
• Restrict sensitive file tools to trusted authenticated callers only.

13) Recommended Fix

• Add canonicalization plus root-boundary enforcement before each filesystem sink.
• Replace free-form path inputs with structured identifiers or allowlisted relative paths.
• Add regression tests covering .., absolute paths, symlink escapes, and mixed-encoding traversal payloads.
• Document the intended trust boundary for all file-oriented MCP/HTTP tools.

14) References

• Repository: https://github.com/getsimpletool/simpletool-server.git
• Reviewed source file: src/mcpo_simple_server/services/prompt_manager/base_manager.py
• https://cwe.mitre.org/data/definitions/73.html

15) Credits

• Discoverer: Winegee
• Discovery method: Static analysis (CodeQL) plus local source-code audit

16) Additional Notes for Form Mapping

• Audit verdict: Confirmed vulnerability.
• Total reviewed SARIF results for this repository/rule group: 2
• Dynamic exploit replay status: not completed in this batch update.
• Version-range accuracy should still be finalized by the maintainer against release history before public disclosure.