T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:34
- Finding
- Authorization requests permissions unrelated to the declared video workflow<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py`, lines 34–37 **Vulnerability Type**: Excessive OAuth authorization scope **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The resulting token is persisted and subsequently accepted only if it contains this complete scope set: ```python or set(value["scope"].split()) != set(SCOPE.split()) ``` The bundled client also exposes a generic tool-call interface: ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The declared Skill workflow requires still-image upload, text-to-speech generation, image-to-video generation, model and voice discovery, task management, artifact reads, and billing operations. It does not declare a need to: - Generate standalone images through `images:generate`. - Generate music through `music:generate`. - Create or modify voices through `voices:write`. Nevertheless, authorization requires these permissions and rejects an otherwise valid credential if its scope is narrower. This violates least privilege. The risk is amplified because `~/.beatra/credentials.json` contains a shared Device Token and `mcp_client.py call` accepts an arbitrary MCP tool name and arbitrary JSON arguments from standard input. The local client does not restrict calls to the tools used by this particular Skill. ### Attack Path 1. The user runs `scripts/authorize.py` to enable the homestay talking-clip workflow. 2. The authorization request asks for image generation, music generation, voice writing, wallet spending, and other account-wide capabilities. 3. The broad bearer token is stored in `~/.beatra/credentials.json`. 4. A compromised Skill update, malicious agent instruction, or another ...[truncated 1072 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define a package-specific minimum scope set containing only capabilities required by this workflow. 2. Remove at least `images:generate`, `music:generate`, and `voices:write` unless a documented feature demonstrably needs them. 3. Do not reject an existing credential merely because it lacks unrelated permissions. Validate that it contains the minimum required subset. 4. Replace the unrestricted `call <tool_name>` interface with an allowlist appropriate to this package, such as: - `beatra.assets.upload` - `beatra.models.list` - `beatra.voices.list` - `beatra.speech.synthesize` - `beatra.videos.animate` - Required task and wallet read operations 5. Require an explicit, separately confirmed elevation flow if a future feature needs additional scopes. 6. Prefer per-package or capability-bound tokens instead of sharing one full-scope bearer token across all Beatra Skills. 7. Display the requested capabilities clearly on the authorization page and explain why each one is needed. ]]>