T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/authorize.py:33
- Finding
- Overprivileged Shared Device Credential and Unrestricted MCP Tool Dispatch## Vulnerability Details **File Location**: `scripts/authorize.py:33-37`; secondary dispatch location: `scripts/mcp_client.py:1463-1481` **Vulnerability Type**: Excessive OAuth scopes and unrestricted authenticated tool invocation **Risk Level**: Medium ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The authenticated command handler permits the caller to supply an arbitrary MCP tool name: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared purpose is to upload authorized photographs and generate one video clip per photograph. Its legitimate operations require capabilities such as artifact upload, model discovery, video generation, wallet reads, and task inspection or cancellation. The requested credential additionally includes unrelated privileges for image generation, music generation, speech generation, voice reads, and voice writes. These permissions are not necessary for the declared photo-to-video workflow. The authorization documentation also states that this is a shared, ful ...[truncated 2168 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the full shared scope with the minimum capabilities required by this package: - Artifact upload/write. - Model discovery. - Video generation. - Necessary task read and user-requested cancellation. - Wallet read operations only where required. 2. Remove image, music, speech, and voice permissions from this Skill's authorization request. 3. Use package-specific or capability-specific credentials instead of one full-scope credential shared by all Beatra Skills. 4. Add a strict local allowlist in `mcp_client.py` for this package, covering only documented tools such as: - `beatra.assets.upload` - `beatra.models.list` - `beatra.videos.animate` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.tasks.cancel` - Required read-only wallet tools - Installation registration, if retained 5. Reject all other tool names before creating an authenticated request. 6. Require fresh, explicit user authorization whenever a package genuinely needs additional scopes. 7. Display the requested capabilities clearly on the approval page so users can make an informed authorization decision.