T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/tcm_constitution_recognition_analysis.py:43- Finding
Unverified caller-supplied identity enables access to another user's health reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tcm_constitution_recognition_analysis.py:43-60;skills/smyx_common/scripts/util.py:452-470, 550-565, 576-604
Vulnerability Type: Improper authentication and user-identity impersonation
Risk Level: HighVulnerable Code
scripts/tcm_constitution_recognition_analysis.py:43-60:python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) parser.add_argument("--list", action='store_true', help="显示中医体质识别分析列表清单") parser.add_argument("--api-url", help="服务端API地址") parser.add_argument("--api-key", help=argparse.SUPPRESS) parser.add_argument("--output", help="结果输出文件路径") parser.add_argument("--detail", choices=["basic", "standard", "json"], default=ConstantEnum.DEFAULT__OUTPUT_LEVEL, help="输出详细程度") parser.add_argument("--export-env-only", action='store_true', help="仅输出 export 命令设置环境变量，不执行分析") args = parser.parse_args() try: # 初始化内部用户身份；不要求用户输入，也不在帮助信息中展示。 OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) # 检查必需参数 if args.list: open_id = ConstantEnum.CURRENT__OPEN_ID result = show_analyze_list(open_id) print(result) exit(0)skills/smyx_common/scripts/util.py:452-470:python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """解析并初始化当前 open-id，返回最终使用值。""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not Const ...[truncated 5047 chars]- Remediation
View remediation
Remediation Suggestions
- Remove or strictly disable the caller-controlled
--open-idoption in production entry points. - Accept user identity only from a trusted upstream authentication context carrying a cryptographically signed assertion.
- Verify the assertion's signature, issuer, audience, expiration, nonce, and intended Skill before assigning
CURRENT__OPEN_ID. - Never authenticate or issue tokens solely from an
openIdor mobile value supplied by the client. Require a proper login credential, one-time challenge, or trusted service-to-service credential. - Bind report-list and analysis operations to the subject encoded in the authenticated token. The server must ignore or reject client-provided identities that differ from that subject.
- Disable silent registration during report access and separate account creation from authentication.
- Partition or encrypt locally cached tokens and ensure cached credentials cannot be selected solely by a caller-provided username.
- Add server-side authorization tests confirming that one authenticated user cannot list, retrieve, or create reports under another user's Open ID.
- Log rejected identity mismatches without recording complete identifiers or authentication tokens.
- Remove or strictly disable the caller-controlled