# MCP Markdownify Arbitrary File Read via get-markdown-file

- **Severity:** High
- **Signature ID:** `7f3c1d2a-8b64-4e19-9c0f-2d5a6b8e4713`
- **OWASP:** LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

Some versions of the mcp-markdownify-server accept a file path argument without checking it, so a tool meant to turn documents into markdown can be pointed at any file on disk. Attackers can use this to read credentials, SSH keys, or other sensitive files by disguising the request as a normal conversion job.

## How the attack works

An attacker (or a compromised agent workflow) calls the get-markdown-file tool on a markdownify server. Instead of a normal document path, the path argument contains either a directory-traversal sequence (like repeated '../' or its percent-encoded form) or an absolute path to a sensitive location such as a credentials file, SSH key, or process memory. Because the server does not canonicalise or restrict the path to a workspace, it opens and converts whatever file is named. The attacker receives the file's contents rendered as markdown, effectively exfiltrating it through a document-conversion feature.

## Why it matters

An organisation can lose confidentiality of secrets, credentials, private keys, or other sensitive files that were never meant to be exposed to the tool-calling agent or its operator, with no authentication barrier in the vulnerable versions.

## What you can do

- Upgrade mcp-markdownify-server to 1.0.0 or later, or apply path canonicalisation and workspace containment yourself if running an older version.
- Restrict which file paths the markdownify tool can access, ideally via an allowlist scoped to a documentation directory.
- Review logs for get-markdown-file / get_markdown_file calls containing '../' sequences, percent-encoded traversal, or absolute paths to credential or memory locations.
- Treat any legitimate need to convert files outside the workspace root as an exception requiring explicit approval, not routine tool behaviour.

## Known benign look-alikes

- Authorised red-team or CVE-validation runs against a deliberately vulnerable mcp-markdownify-server instance; the arguments are indistinguishable from a real exploit and this rule will fire, which is the intended behaviour during testing.
- A documentation pipeline that legitimately converts a file two or more directory levels above the workspace root (e.g. a monorepo packaging step passing "../../shared/README.md"). This matches sel_traversal only; it does not touch a credential target, and the report verdict leaves the conversion unaffected.
- An operator intentionally converting an infrastructure config file that happens to live under a dotfile directory (for example rendering a committed ".aws/config" sample into markdown for a runbook).
- A markdown source file whose name ends in ".key" or ".env" by local convention; the pattern requires the extension to terminate the JSON string value, so ".env.md" and "secrets.key.md" do not match.

## References

- https://attack.mitre.org/techniques/T1005/
- https://attack.mitre.org/techniques/T1552/001/
- https://github.com/zcaceres/markdownify-mcp

---
Source: https://www.netzilo.com/threats/mcp-markdownify-arbitrary-file-read