T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/authorize.py:34- Finding
Over-Privileged Shared Device Token Enables Unrelated Beatra Operations
- Content
View full analysis
Vulnerability Details
File Location:
scripts/authorize.py:34-38
Vulnerability Type: Excessive OAuth scope and missing least-privilege enforcement
Risk Level: HighComplete Code Snippet
python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" )The resulting token is subsequently accepted by a generic tool dispatcher in
scripts/mcp_client.py:1466-1479:python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, )Technical Analysis
The declared Skill functionality is music creation, reference-audio upload, model discovery, and management of associated asynchronous tasks. However, authorization requests a shared bearer token containing unrelated capabilities, including:
- Image generation
- Video generation
- Speech generation
- Voice read and write operations
- General artifact read and write access
- Wallet spending
- Task cancellation
The token is shared with other Beatra packages through
~/.beatra/credentials.json. The command-line client also accepts an arbitrary MCP tool name without enforcing a package-specific allowlist. Consequently, local code capable of invoking the bundled client can attempt ope ...[truncated 1308 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the shared full-scope token with a package-specific token restricted to required music operations.
- Remove image, video, speech, voice-write, and unrelated artifact permissions from this Skill's authorization request.
- Separate wallet authorization from generation authorization, or constrain spending to explicitly approved music operations.
- Add a local allowlist of permitted MCP tools, such as music generation, model discovery, reference upload, and task operations required by this workflow.
- Reject arbitrary tool names before establishing an authenticated session.
- Use separate credentials for packages requiring materially different capabilities.
- Display the exact requested scopes during authorization and require renewed consent whenever privileges expand.