T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/authorize.py:34- Finding
Overprivileged Device Authorization Combined with Unrestricted MCP Tool Dispatch
- Content
View full analysis
dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared functionality is a holiday-homework speech generator. It legitimately needs text-to-speech, selected voice operations, limited artifact upload, task-status access, and potentially billing information. The authorization request nevertheless includes unrelated image, video, and music generation capabilities, along with wallet spending and task cancellation. This violates least privilege because compromise or misuse of the shared bearer credential exposes capabilities that are not necessary to produce homework audio. The risk is amplified by `_run_command`, which accepts an arbitrary MCP tool name and forwards it to `tools/call` without a package-level allowlist. The remote service may still enforce the token's granted scopes and its own tool schemas. How ...[truncated 1647 chars]- Remediation
View remediation