T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:34
- Finding
- Overbroad Device Token Scope Combined with Unrestricted Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; `scripts/mcp_client.py:1463-1481` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared purpose is to upload one product image and generate one image-to-video result. Its authorization request nevertheless includes unrelated capabilities for image generation, music generation, speech generation, voice reading and writing, wallet spending, artifact access, and task cancellation. The client compounds this excessive scope by forwarding any command-line `tool_name` to the remote MCP endpoint. It does not enforce a package-specific allowlist. Consequently, the effective authorization boundary is determined entirely by the broad bearer token and server-side controls rather than by the functionality declared by this Skill. The credential is shared through `~/.beatra/credentials.json`, increasing the consequences of token comprom ...[truncated 1297 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Request a package-specific token containing only the scopes required for: - Model-card discovery. - Product-image upload. - Image-to-video generation. - Task status reads. - User-requested task cancellation. - Read-only wallet operations only when those features are used. 2. Remove unrelated image, music, speech, and voice permissions. 3. Separate read-only wallet access from spending authorization where the service supports it. 4. Add a strict local allowlist in `_run_command`, for example: - `beatra.models.list` - `beatra.assets.upload` - `beatra.videos.animate` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.tasks.cancel` - `beatra.wallet.get` - `beatra.wallet.ledger` 5. Reject all unrecognized tool names before creating the MCP request. 6. Use separate credentials per package or per capability instead of one shared full-scope token. 7. Add automated tests proving that unrelated tools cannot be called through this package. ]]>