T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/smyx_farmland_weed_identification_analysis.py:43- Finding
Caller-Controlled Identity Can Obtain Account Tokens and Access Another Identity's Reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_farmland_weed_identification_analysis.py:43,58;skills/smyx_common/scripts/util.py:551-561,576-612;skills/smyx_analysis/scripts/skill.py:141-158
Vulnerability Type: Authentication bypass through an unverified caller-supplied identity
Risk Level: HighVulnerable Code
The entry point accepts a hidden identity argument and establishes it as the current identity without proving ownership:
python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS)python OpenIdUtil.resolve_current_open_id( args.open_id, use_current=bool(args.open_id) )The shared request layer uses that identity as both the remote
openIdandmobilevalue in a silent registration/login operation:python _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): return _response_json and _response_json.get("result")Tokens returned for the selected identity are then stored and attached to subsequent service requests:
python new_current_user = _get_or_create_user(current__user_name) if new_current_user: ApiEnum.TOKEN = new_current_user.get("token") ApiEnum.OPEN_TOKEN = new_current_user.get("openToken") current_user_info = new_current_user.get("userInfo") if current_user_info: current_user_info["token"] = new_current_user.get("token") current_user_info["openToken"] = new_current_user.get( "openToken")python headers.setdefault("X-Access-Token", ApiEnum.TOKEN) headers.setdefault("X-Api-Key", ApiEnum.API_SECRET_KEY) headers.setdefault("Authorization", ApiEnum. ...[truncated 2810 chars]- Remediation
View remediation
Remediation Suggestions
- Remove caller-controlled identity initialization from the public CLI. Do not accept
--open-idunless it is restricted to a trusted internal invocation channel. - Require a signed identity assertion, authenticated platform session, or equivalent server-verifiable credential before assigning an identity.
- Redesign
/sys/phoneLoginso knowledge ofopenIdormobileis not sufficient to obtain tokens. Require an ownership challenge, trusted-provider signature, or established authenticated session. - Disable automatic registration during ordinary analysis and report-query operations.
- Bind report access exclusively to the verified token subject. Ignore or reject request identity fields that conflict with that subject.
- Validate authorization server-side for every report-list, report-detail, export, and analysis-result request.
- Store tokens only after successful verified authentication, use restrictive file permissions, and invalidate tokens previously created through the silent identity flow.
- Add tests confirming that supplying another user's identifier cannot create a session, retrieve reports, submit analyses, or reuse cached credentials.
- Remove caller-controlled identity initialization from the public CLI. Do not accept