T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skills/smyx_common/scripts/util.py:549- Finding
Caller-Controlled Identity Can Be Exchanged for Cloud Access Tokens
- Content
View full analysis
Vulnerability Details
File Location:
scripts/visual_summary_analysis.py:44-59;skills/smyx_common/scripts/util.py:449-470, 549-612
Vulnerability Type: Improper authentication and caller-controlled identity impersonation
Risk Level: HighVulnerable Code
python # scripts/visual_summary_analysis.py:44-59 parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) args = parser.parse_args() try: # Initialize the internal user identity. OpenIdUtil.resolve_current_open_id( args.open_id, use_current=bool(args.open_id) ) if args.list: open_id = ConstantEnum.CURRENT__OPEN_ID result = show_analyze_list(open_id) print(result) exit(0)python # skills/smyx_common/scripts/util.py:449-470 @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """Resolve and initialize the current open-id.""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idpython # skills/smyx_common/scripts/util.py:549-612 def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json ...[truncated 3571 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the caller-controlled
--open-idoverride from the production CLI unless it is strictly required for a trusted administrative workflow. - Do not issue access tokens based solely on an Open ID, username, or mobile value. Require proof of identity such as:
- a signed assertion from a trusted upstream identity provider;
- an authenticated session bound to the identity;
- a one-time challenge;
- or another server-verified credential.
- Verify the assertion's signature, issuer, audience, expiration, nonce, and subject before assigning
CURRENT__OPEN_ID. - Bind the authenticated subject to the requested account server-side. Never rely on a client-supplied identity field as authorization evidence.
- Disable silent account registration during ordinary report queries. Separate account provisioning from authentication and require an explicit, authenticated enrollment process.
- Ensure report-list and analysis APIs derive the tenant and user identity from the validated access token rather than from request parameters such as
pnaUserName. - Reject attempts to override an already authenticated identity and log identity-switch attempts without recording tokens.
- Add tests proving that supplying another user's identifier cannot obtain credentials, enumerate reports, or create analyses under that account.
- Remove the caller-controlled