T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:34
- Finding
- Overprivileged Shared Device Token and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-38`; `scripts/mcp_client.py:1466-1481`; `scripts/mcp_client.py:1488-1490` **Vulnerability Type**: Excessive authorization scope and unrestricted remote tool selection **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The Skill obtains a shared bearer token that grants broad access to Beatra tools. The requested scope includes unrelated capabilities such as music generation, image generation, general wallet spending, and task cancellation. The declared quarterly-report workflow primarily requires asset upload, optional voice operations, speech generation, video generation, and related task reads. The client compounds this excessive scope by accepting any MCP tool name from the command line. It does not enforce a local allowlist corresponding to the operations documented by the Skill. Therefore, a ...[truncated 1260 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope token with a package-specific, least-privilege credential. 2. Remove permissions unrelated to this workflow, particularly `music:generate` and unrelated image-generation access. 3. Separate read-only wallet access from spending authorization. 4. Add a hardcoded local allowlist of documented tool names. 5. Reject any tool name outside that allowlist before creating an MCP session. 6. Require explicit user confirmation immediately before wallet-spending, generation, or cancellation operations. 7. Use separate credentials or capability tokens for destructive operations such as task cancellation. 8. Add server-side enforcement so source-package attribution cannot invoke tools outside the package's approved capabilities. ]]>