T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/smyx_child_separation_anxiety_detection_analysis.py:45- Finding
Caller-Controlled Identity Enables Account Impersonation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_child_separation_anxiety_detection_analysis.py:45-61;skills/smyx_common/scripts/util.py:552-612;skills/smyx_analysis/scripts/skill.py:145-151
Vulnerability Type: Authentication based on an unverified caller-supplied identity
Risk Level: HighTechnical Analysis
The executable accepts a hidden
--open-idargument and treats its value as the current authenticated identity without verifying that the caller owns that identity:python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) ... OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))The resolved identity is subsequently used by the shared request utility. When no cached tokens are available, the utility submits the supplied identity to a silent login and registration endpoint as both
openIdandmobile:python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result") except Exception as _e: CommonUtil.trace_exception_stack(_e) return {}Tokens returned by that endpoint are persisted and then attached to subsequent cloud API requests:
python current__user_name = ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User user_dao = UserDao() found_user = us ...[truncated 3881 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the public
--open-idargument from the executable. Hiding an argument from help output does not make it trusted. - Obtain user identity only from an authenticated integration channel controlled by the host platform.
- Require a cryptographically signed identity assertion with validated issuer, audience, subject, expiration, and nonce claims.
- Never treat a username, mobile number, open ID, environment value, or other bare identifier as proof of account ownership.
- Separate registration from authentication. Registration should require an explicit verification process, while login should require an established credential or trusted federated assertion.
- Disable silent registration during ordinary report and analysis requests.
- Enforce server-side authorization on report listing, result retrieval, report export, and analysis submission. Every record should be checked against the authenticated server-side subject rather than a client-provided identity field.
- Do not persist tokens returned from an unverified identity claim. Store valid tokens in a protected credential store with restrictive permissions, expiration handling, and revocation support.
- Avoid process-global mutable identity and token state. Pass an immutable authenticated principal through each request context to prevent identity confusion between operations.
- Add negative authorization tests proving that one user cannot select another identity, obtain tokens for it, list its reports, retrieve its results, or submit analyses under its account.
- Remove the public