T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/authorize.py:30
- Finding
- Overprivileged Device Token Permits Operations Unrelated to Video Restyling<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:30-34`; `scripts/mcp_client.py:1463-1482` **Vulnerability Type**: Excessive authorization scope and unrestricted MCP tool dispatch **Risk Level**: Medium ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The client also allows the caller to provide an arbitrary MCP tool name: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared Skill functionality is video restyling. Its legitimate requirements include uploading media, discovering compatible video-edit models, initiating video-edit tasks, reading task results, optionally cancelling tasks, and reading relevant billing information. The authorization request nevertheless includes unrelated capabilities for: - Image generation - Music generation - Speech generation - Voice reading and writing - General wallet spending - Broad MCP tool access The local client does not restrict `tool_name` to the tools required by this package. Any local caller able to invoke the script as the user can select an arbitrary MCP tool, with server-side authoriz ...[truncated 1659 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope token with a package-specific or capability-specific token. 2. Limit requested scopes to those strictly needed for this Skill, such as: - Video editing - User-selected media upload - Video model discovery - Task read and user-requested cancellation - Read-only wallet or ledger access, if required 3. Remove image, music, speech, and voice scopes unless the user explicitly invokes a separate workflow requiring them. 4. Separate read-only billing access from spending authority. Request spending authorization only immediately before a user-approved paid operation where the platform supports incremental authorization. 5. Add a local allowlist for permitted MCP tools. For this Skill, allow only explicitly required operations such as: - `beatra.models.list` - `beatra.assets.upload` - `beatra.videos.edit` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.tasks.cancel` - Required read-only wallet operations - Installation registration, if retained 6. Reject all other tool names before loading or transmitting the bearer credential. 7. Use separate credentials for unrelated Beatra packages instead of allowing every package to inherit the same full account scope. 8. Display the exact requested capabilities on the authorization page so the user can make an informed decision. ]]>