fast-mcp-telegram Path Traversal Authentication Bypass

Technical Analysis

The vulnerability stems from unsafe construction of a session-file path directly from an attacker-supplied Bearer token, with only a blocklist check against the exact string 'telegram' rather than proper path normalization or an allowlist. By supplying a token like '../fast-mcp-telegram/telegram', an attacker traverses out of the intended session directory and resolves to the default session file at ~/.config/fast-mcp-telegram/telegram.session, which the server treats as valid authentication. This crosses a critical trust boundary in the MCP protocol layer: the account-prefixed tool namespace (meant to isolate multi-user sessions) still exposes and permits calls against the default account's tools once the session is hijacked, negating the intended segregation. The attacker gains full impersonation of the legacy/default Telegram account through the MCP tool interface without needing valid credentials, entirely via a crafted HTTP header value.

Affected Systems

fast-mcp-telegram; protocols: MCP

Detection Signatures

• Bearer tokens containing path traversal sequences such as '../' or '..\\' in Authorization headers
• HTTP requests to MCP server session endpoints with non-alphanumeric or path-separator characters in token value
• Log entries showing session file resolution paths outside expected session directory (e.g., resolving to ~/.config/fast-mcp-telegram/telegram.session unexpectedly)
• Unexpected access to default/legacy account tools by sessions expected to be scoped to prefixed accounts

Remediation Steps

1. 1

   Upgrade to fixed version

   Update fast-mcp-telegram to version 0.19.1 or later, which addresses the path traversal and session validation bypass.

2. 2

   Sanitize and normalize tokens

   Ensure any token-derived file path is canonicalized and validated against an allowlist of expected session identifiers before use, rejecting any path separators or traversal sequences.

3. 3

   Enforce strict token format validation

   Require Bearer tokens to match a strict pattern (e.g., alphanumeric/UUID) and reject any token containing '/', '\\', or '..'.

4. 4

   Audit session isolation logic

   Verify that account-prefixed tool exposure logic independently enforces session ownership rather than relying solely on the reserved-name blocklist.

5. 5

   Monitor and restrict network exposure

   Limit remote HTTP access to the MCP server to trusted networks/VPNs until patched, and monitor logs for anomalous session file access.