T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/smyx_pregnancy_emotion_soothing_analysis.py:50- Finding
Caller-Controlled Identity Enables Cross-User Cloud Report Access
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_pregnancy_emotion_soothing_analysis.py:50-60;skills/smyx_common/scripts/util.py:442-454, 553-566, 580-612
Vulnerability Type: Identifier-only authentication and broken access control
Risk Level: HighVulnerable Code
scripts/smyx_pregnancy_emotion_soothing_analysis.py:50-60python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) parser.add_argument("--list", action='store_true', help="显示孕妇情绪波动舒缓历史安抚记录清单") parser.add_argument("--api-url", help="服务端API地址") parser.add_argument("--api-key", help=argparse.SUPPRESS) parser.add_argument("--output", help="结果输出文件路径") parser.add_argument("--detail", choices=["basic", "standard", "json"], default=ConstantEnum.DEFAULT__OUTPUT_LEVEL, help="输出详细程度") parser.add_argument("--export-env-only", action='store_true', help="仅输出 export 命令设置环境变量，不执行分析") args = parser.parse_args() try: # 初始化内部用户身份；不要求用户输入，也不在帮助信息中展示。 OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id))skills/smyx_common/scripts/util.py:442-454python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """解析并初始化当前 open-id，返回最终使用值。""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idskills/smyx_common/scripts/util.py:553-566python def _get_or_create_user(username): _url = ApiEnum.BASE ...[truncated 4744 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the caller-controlled
--open-idoption from the public executable rather than merely suppressing it from help output. - Bind the current identity to an authenticated upstream principal. If identity propagation is required, accept only a signed, audience-bound, short-lived assertion issued by a trusted identity provider.
- Change the server-side login flow so possession of an
openIdor mobile identifier is never sufficient to issue access tokens. - Disable automatic registration in the login path used for report access, or separate registration from authentication with explicit verification.
- Enforce ownership and tenant authorization on every report-list, report-detail, and analysis-submission endpoint. Do not rely on client-supplied identity fields.
- Reject mismatches between the authenticated token subject and any
openId, username, orpnaUserNameincluded in request data. - Avoid persisting tokens obtained through unverified identity selection. Store legitimate tokens in an operating-system credential store with restrictive access controls and defined expiration.
- Add tests proving that changing
--open-id,pnaUserName, or equivalent request fields cannot access another user's reports. - Log and alert on silent-login attempts where the asserted identifier differs from the authenticated upstream subject.
- Remove the caller-controlled