T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/smyx_depression_behavioral_markers_analysis.py:49
- Finding
- Caller-Controlled Identity Enables Unauthorized Report-Account Impersonation## Vulnerability Details **File Location**: `scripts/smyx_depression_behavioral_markers_analysis.py:49, 56-61`; `skills/smyx_common/scripts/util.py:552-566, 578-612`; `skills/smyx_analysis/scripts/skill.py:144-160` **Vulnerability Type**: Caller-controlled identity used for silent authentication **Risk Level**: High ### Complete Code Snippets `scripts/smyx_depression_behavioral_markers_analysis.py:49, 56-61`: ```python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) args = parser.parse_args() try: # Initialize the internal user identity. OpenIdUtil.resolve_current_open_id( args.open_id, use_current=bool(args.open_id) ) if args.list: open_id = ConstantEnum.CURRENT__OPEN_ID result = show_analyze_list(open_id) print(result) exit(0) ``` `skills/smyx_common/scripts/util.py:552-566`: ```python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result") except Exception as _e: CommonUtil.trace_exception_stack(_e) return {} ``` `skills/smyx_common/scripts/util.py:578-612`: ```python current__user_name = ( ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID ) found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: try: from .dao import UserDao, User ...[truncated 5199 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--open-id` from the public CLI and do not accept account identity from ordinary Skill parameters. 2. Obtain identity exclusively from a trusted, authenticated integration channel, such as a signed upstream assertion with issuer, audience, expiration, and nonce validation. 3. Require the server to authenticate users independently. Do not issue bearer tokens based solely on caller-supplied `openId` or `mobile` values. 4. Disable silent registration and login for arbitrary identifiers. If automatic provisioning is required, bind it to a verified platform identity and reject mismatches. 5. Enforce object-level authorization on every report-list, report-detail, export, and analysis endpoint. Confirm that the authenticated principal owns or is explicitly authorized to access each record. 6. Do not rely on hidden command-line arguments as a security control. Reject identity overrides even if supplied through direct module invocation. 7. Keep per-principal token storage isolated and validate that cached token ownership matches the authenticated upstream principal before reuse. 8. Add negative authorization tests covering guessed identifiers, cross-user report listing, cross-user report export, cached-token substitution, and analysis creation under another identity. 9. Invalidate tokens created through the unauthenticated silent-login path and review server logs for cross-account access using arbitrary identity values.