T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:34
- Finding
- Overprivileged Shared Device Token and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; `scripts/mcp_client.py:1463-1481` **Vulnerability Type**: Violation of least privilege and unrestricted privileged tool invocation **Risk Level**: High ### Code Snippets `scripts/authorize.py:34-37`: ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` `scripts/mcp_client.py:1463-1481`: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared purpose of this Skill is to turn census schedules into speech clips, with optional voice cloning and media upload. The authorization request nevertheless obtains permissions for unrelated image, video, and music generation, as well as wallet spending, voice modification, artifact access, and task cancellation. The resulting bearer credential is shared between Beatra Skills and is accepted by a generic MCP client. The `call` command accepts an arbitrary `tool_name` and forwards it directly to the remote service without a package-local allowlist or capability check. Consequently, the client itself does not constrain operations to those required by the census speech wor ...[truncated 1456 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope authorization request with the narrowest scopes required for: - Speech synthesis. - Required model and voice reads. - Explicitly requested voice cloning. - Explicit media upload. - Task creation and status reads. 2. Do not request image, video, music, wallet-spending, voice-writing, or task-cancellation privileges unless the current package genuinely requires them. 3. Introduce a strict client-side allowlist of MCP tool names appropriate to this Skill. 4. Separate read-only and paid operations into distinct authorization capabilities. 5. Require explicit user confirmation immediately before voice cloning, paid generation, cancellation, or any other state-changing operation. 6. Prefer package-bound or audience-bound tokens so one Skill cannot exercise privileges granted for unrelated Skills. 7. Validate the requested tool against both the package allowlist and the operation-specific input schema before sending it. ]]>