T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/cat_face_recognition_analysis.py:44- Finding
Caller-Controlled Open ID Enables Cloud Identity Impersonation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/cat_face_recognition_analysis.py:44-55;skills/smyx_common/scripts/util.py:460-475, 550-612
Vulnerability Type: Caller-controlled identity used for silent authentication
Risk Level: HighVulnerable Code
scripts/cat_face_recognition_analysis.py:44-55:python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) parser.add_argument("--list", action='store_true', help="显示猫脸识别分析列表清单") parser.add_argument("--api-url", help="服务端API地址") parser.add_argument("--api-key", help=argparse.SUPPRESS) parser.add_argument("--output", help="结果输出文件路径") parser.add_argument("--detail", choices=["basic", "standard", "json"], default=ConstantEnum.DEFAULT__OUTPUT_LEVEL, help="输出详细程度") parser.add_argument("--export-env-only", action='store_true', help="仅输出 export 命令设置环境变量，不执行分析") args = parser.parse_args() try: # 初始化内部用户身份；不要求用户输入，也不在帮助信息中展示。 OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))skills/smyx_common/scripts/util.py:460-475:python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """解析并初始化当前 open-id，返回最终使用值。""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idskills/smyx_common/scripts/util.py:550-565:python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" ...[truncated 4600 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
--open-idfrom the public CLI rather than merely suppressing its help text. - Obtain identity only from a trusted, authenticated upstream channel.
- Require an integrity-protected identity assertion, such as a server-validated signed token containing the caller identity and audience.
- Do not issue or retrieve access tokens based only on a caller-supplied Open ID, username, or mobile value.
- Disable silent registration during ordinary analysis and report-list operations.
- Bind locally cached tokens to the authenticated upstream principal and verify that binding before reuse.
- Enforce authorization on the server for every report-list, report-detail, and analysis operation; never rely solely on client-provided
pnaUserName. - Reject execution when authenticated identity cannot be established instead of accepting an arbitrary identifier.
- Add negative authorization tests demonstrating that one principal cannot request tokens or reports for another Open ID.
- Remove