T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/smyx_living_alone_rhythm_anomaly_analysis.py:56
- Finding
- Workspace-Wide Fallback Identity Can Expose Reports Across Users## Vulnerability Details **File Location**: `scripts/smyx_living_alone_rhythm_anomaly_analysis.py:56-62`; supporting identity resolution in `skills/smyx_common/scripts/util.py:458-469` **Vulnerability Type**: Improper user identity isolation and cross-user data access **Risk Level**: High ### Vulnerable Code `scripts/smyx_living_alone_rhythm_anomaly_analysis.py:56-62`: ```python # 初始化内部用户身份；不要求用户输入，也不在帮助信息中展示。 OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) # 检查必需参数 if args.list: open_id = ConstantEnum.CURRENT__OPEN_ID result = show_analyze_list(open_id) print(result) exit(0) ``` `skills/smyx_common/scripts/util.py:458-469`: ```python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """解析并初始化当前 open-id，返回最终使用值。""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_id ``` ### Technical Analysis The command-line entry point passes `use_current=bool(args.open_id)`. In the normal documented workflow, the hidden `--open-id` argument is omitted, making `use_current` false. As a result, `resolve_current_open_id()` skips the identity already loaded into `ConstantEnum.CURRENT__OPEN_ID` from the authenticated sender environment. The resolver instead reads the workspace-wide `data/smyx-api-key.txt` value or reuses the first generated `User_*` record from the shared SQLite database. When no ...[truncated 2383 chars]
- Remediation
- ## Remediation Suggestions 1. Always prefer the authenticated sender identity when initializing the current user: ```python OpenIdUtil.resolve_current_open_id(args.open_id, use_current=True) ``` 2. In multi-user deployments, reject analysis and history operations when no authenticated sender identity is available instead of silently using a workspace-wide account. 3. If anonymous fallback operation is required, derive and store fallback identities per authenticated sender or tenant rather than selecting the first `User_*` record in a shared database. 4. Bind locally cached tokens to both the authenticated sender and tenant. Do not look up tokens solely through a workspace-global fallback username. 5. Enforce ownership and tenant authorization on the server for every analysis, polling, export, and history-list request. Do not rely only on the client-provided `pnaUserName`. 6. Add multi-user isolation tests covering: - Two different sender open IDs in one workspace. - Missing `--open-id`. - Missing sender username. - History queries after each user uploads a report. - Attempts to retrieve or export another sender's report ID. 7. Migrate existing shared fallback records carefully. Require an administrator or authenticated owner to assign existing reports to the correct account rather than exposing them through the legacy shared identity.