T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- src/clinstagram/commands/_dispatch.py:162
- Finding
- Forced Backend Selection Bypasses Compliance Policy Enforcement## Vulnerability Details **File Location**: `src/clinstagram/commands/_dispatch.py:162-169` **Vulnerability Type**: Compliance policy and access-control bypass **Risk Level**: Medium ### Vulnerable Code ```python # Force backend override forced = ctx.obj.get("backend") if forced and forced.value != "auto": backend_name = forced.value else: router = _get_router(ctx) backend_name = router.route(feature) if backend_name is None: ``` ### Technical Analysis Automatic backend selection passes through `Router.route()`, which applies both capability checks and compliance-policy restrictions. In contrast, an explicitly supplied backend, such as `--backend private`, is accepted directly without verifying: - Whether the selected backend is allowed by the configured compliance mode. - Whether the backend advertises support for the requested feature. - Whether private API access is prohibited under `official-only`. - Whether the requested private operation is restricted under `hybrid-safe`. This means the documented `official-only` guarantee of “Graph API only” is not enforced when a backend override is supplied. The separate growth-action gate protects only certain actions, such as follow, unfollow, like, unlike, and comment creation. It does not provide general enforcement for all private API operations or all mutations. ### Attack Path 1. A user configures the Skill in `official-only` or `hybrid-safe` mode. 2. A private API session remains present in the OS keychain. 3. An agent or user invokes a command with `--backend private`. 4. `dispatch()` assigns `backend_name` directly from the forced option. 5. `Router.route()` and its compliance checks are skipped. 6. `_instantiate_backend()` loads the stored private session. 7. The requested private API operation executes despite the configured restriction. ### Impact Assessment The bypass allows use of an unofficial Instagram private API out ...[truncated 481 chars]
- Remediation
- ## Remediation Suggestions - Route both automatic and explicit backend selections through one policy-enforcement function. - Add a public router method that accepts a requested backend and verifies both `can_backend_do(backend, feature)` and compliance-mode authorization. - Reject a forced private backend under `official-only`. - Under `hybrid-safe`, permit the private backend only for features explicitly included in `READ_ONLY_FEATURES`. - Return `ExitCode.POLICY_BLOCKED` for compliance violations and `ExitCode.CAPABILITY_UNAVAILABLE` when the selected backend does not implement the feature. - Consider deleting or disabling private sessions when switching to `official-only`, or clearly offer that as an option. - Add regression tests covering forced private selection for every compliance mode, including mutation and read-only operations. A safe structure would resemble: ```python router = _get_router(ctx) forced = ctx.obj.get("backend") if forced and forced.value != "auto": backend_name = router.route_forced(feature, forced.value) else: backend_name = router.route(feature) ``` `route_forced()` must reject the request unless both the capability matrix and compliance policy authorize it.