T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skills/smyx_common/scripts/util.py:429- Finding
Workspace-Wide Fallback Identity Can Expose Reports Across Users
- Content
View full analysis
Vulnerability Details
File Location:
skills/smyx_common/scripts/util.py:429-458; related call site:scripts/smyx_child_bedtime_soothing_analysis.py:59-67
Vulnerability Type: Shared fallback identity causing cross-user report access
Risk Level: HighComplete Code Snippet
python @classmethod def get_or_create_default_open_id(cls): from .dao import UserDao, User import uuid user_dao = UserDao() user = user_dao.get_first_default_user(cls.DEFAULT_PREFIX, cls.DEFAULT_USERNAME_LENGTH) if user and user.username: return user.username for _ in range(10): username = cls.generate_default_open_id() if user_dao.get_by_username(username): continue now = datetime.now() user = User( id=uuid.uuid4().hex, username=username, realname=username, source=ConstantEnum.APP__SOURCE, del_flag=0, create_time=now, update_time=now ) user_dao.add(user) return username raise RuntimeError("Failed to generate a default open-id after repeated collisions") @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idThe corresponding report-listing path is:
python OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) if args.list: open_id = Consta ...[truncated 2493 chars]- Remediation
View remediation
Remediation Suggestions
- Require a verified, per-request principal before allowing historical report access.
- Remove the workspace-global fallback identity from all multi-user execution paths.
- Bind locally cached cloud credentials to an authenticated user and tenant identifier rather than only to a shared workspace.
- Reject
--listwhen a verified user binding is unavailable instead of silently using the first default account. - Add server-side authorization checks that derive report ownership from the authenticated token rather than accepting a client-selected identity.
- Store separate credential databases or records for each authenticated Agent user, with restrictive filesystem permissions.
- Invalidate existing shared fallback tokens and migrate reports to properly isolated identities.
- Add integration tests using two callers in one workspace to verify that neither caller can list or retrieve the other caller’s reports.