T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:31
- Finding
- Overprivileged OAuth Scope and Unrestricted MCP Tool Invocation## Vulnerability Details **File Location**: `scripts/authorize.py:31-34`; `scripts/mcp_client.py:1463-1480` **Vulnerability Type**: Excessive authorization scope and missing client-side tool allowlist **Risk Level**: High ### Vulnerable Code `scripts/authorize.py:31-34`: ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` `scripts/mcp_client.py:1463-1480`: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared functionality centers on public Douyin comment lookup, uploading user-selected assets, generating or editing FAQ images, reading task results, and checking billing information. The authorization request nevertheless includes unrelated capabilities for generating videos, music, and speech, reading and writing voices, spending wallet credits, and cancelling tasks. This violates least privilege because possession of the shared bearer credential grants materially broader account capabilities than the Skill requires. The bundled client compounds the issue by accepting an arbitrary MCP tool name from the command l ...[truncated 1599 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the broad scope with the smallest server-supported package-specific scope set needed for: - Douyin comment lookup. - Image generation, transformation, and editing. - Explicit asset uploads. - Task result reads. - Read-only model, wallet balance, and ledger access. 2. Remove video, music, speech, voice-write, general wallet-spend, and task-cancellation permissions unless a documented workflow specifically requires them. 3. Add a hardcoded client-side allowlist of permitted MCP tool names and reject every other name before creating a session or sending a request. 4. Separate read-only and paid operations where the authorization system supports separate grants. 5. Require explicit, operation-specific user approval for destructive actions such as task cancellation. 6. Prefer server-issued tokens restricted to the package identity, permitted tool names, and relevant resource types. 7. Add regression tests verifying that unrelated tool names and excessive scopes are rejected.