browse-mcp Path Traversal and Origin-Fence Bypass Leading to Arbitrary File Write / RCE

Technical Analysis

The vulnerability stems from browser_download joining an unvalidated, caller-supplied save_dir with a filename before writing a fetched HTTP response body to disk, and from browser_save_state/browser_load_state honoring an attacker-influenced path unchanged, both lacking canonicalization or path-traversal checks. The entry point is dual: a malicious MCP client can invoke the tools directly with crafted paths, or an autonomous agent can be indirectly prompt-injected via content on a visited webpage that instructs it to call these tools with attacker-chosen save_dir/URL values. Because the response body content is also attacker-controlled (the same malicious site can serve the file payload), this crosses the boundary from a passive content-rendering tool into an arbitrary-file-write primitive, enabling persistence via shell rc files, cron entries, or autostart configs and ultimately host-level code execution. The force_fetch fallback compounds the issue by using raw fetch() that ignores BROWSE_MCP_ALLOWED_ORIGINS, defeating the network-level containment the server was designed to provide.

Affected Systems

browse-mcp; protocols: MCP

Detection Signatures

• browser_download calls with save_dir containing '../' or absolute paths outside expected sandbox directories
• browser_save_state/browser_load_state invoked with paths resolving outside intended state directory
• MCP tool call logs showing writes to ~/.bashrc, ~/.profile, crontab files, systemd/autostart directories, or SSH authorized_keys
• force_fetch calls to domains not present in BROWSE_MCP_ALLOWED_ORIGINS
• Webpage content containing embedded instructions directed at 'assistant', 'agent', or tool-call syntax attempting to set download/save paths

Remediation Steps

1. 1

   Upgrade browse-mcp

   Update to browse-mcp version 0.8.2 or later, which fixes the path validation and origin-fence bypass issues.

2. 2

   Sandbox filesystem access

   Run the MCP server in a container or restricted filesystem namespace so writes cannot reach sensitive host paths like shell rc files or cron directories.

3. 3

   Enforce path canonicalization

   Validate and canonicalize all save_dir/state path parameters server-side, rejecting any path that resolves outside an allowed base directory.

4. 4

   Restrict outbound network access

   Enforce BROWSE_MCP_ALLOWED_ORIGINS at the network layer (e.g., egress firewall) rather than relying solely on application-level checks, and audit force_fetch usage.

5. 5

   Treat page content as untrusted

   Do not allow agent planners to derive filesystem paths or tool arguments directly from fetched webpage content without human confirmation or strict allowlisting.