T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skills/smyx_common/scripts/util.py:440- Finding
Shared Fallback Identity Allows Cross-User Access to Sensitive Health Reports
- Content
View full analysis
Vulnerability Details
File Location:
skills/smyx_common/scripts/util.py:440-469
Related Locations:scripts/stroke_risk_screening_analysis.py:220-226,skills/smyx_analysis/scripts/skill.py:142-165,SKILL.md:89-92
Vulnerability Type: Improper user identity isolation and cross-user data access
Risk Level: MediumComplete Code Snippets
skills/smyx_common/scripts/util.py:440-469:python user = user_dao.get_first_default_user(cls.DEFAULT_PREFIX, cls.DEFAULT_USERNAME_LENGTH) if user and user.username: return user.username # Retry on the extremely unlikely event of a username collision. for _ in range(10): username = cls.generate_default_open_id() if user_dao.get_by_username(username): continue now = datetime.now() user = User( id=uuid.uuid4().hex, username=username, realname=username, source=ConstantEnum.APP__SOURCE, del_flag=0, create_time=now, update_time=now ) user_dao.add(user) return username raise RuntimeError("Failed to generate default open-id after repeated collisions") @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """Resolve and initialize the current open-id.""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id()The original source comments and exception message are in Chinese; they are translated above without changing the executable behavior.
scripts/stroke_risk_screening_analysis.py:220-226:python # Initialize the internal user identity ...[truncated 3937 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the workspace-global fallback identity from multi-user execution paths.
- Require a verified, caller-specific principal before uploading health data or returning report history. Fail closed when such an identity is unavailable.
- Bind each local identity record to an authenticated upstream user and tenant rather than selecting the first matching
User_...record. - Pass the verified principal explicitly through the report-list call chain instead of relying on mutable global identity and token state.
- Enforce report ownership and tenant checks on the server for every list, detail, and export request. Do not rely only on client-provided usernames.
- Store authentication tokens in records uniquely scoped to the verified caller, and prevent token reuse across unrelated sessions or users.
- If a single-user fallback mode is required for local installations, make it an explicit configuration mode, disable report-history access by default, and reject concurrent or multi-user use.
- Add integration tests with two distinct callers to verify that one caller cannot list, retrieve, or export the other caller's reports.