T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/authorize.py:34
- Finding
- Overprivileged Authorization Scope and Unrestricted MCP Tool Dispatch## Vulnerability Details **File Location**: `scripts/authorize.py:34-36`; `scripts/mcp_client.py:1463-1481` **Vulnerability Type**: Excessive authorization scope and unrestricted remote tool selection **Risk Level**: Medium ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared function of this Skill is to produce homework voice clips and, when authorized, clone a voice from a supplied sample. Its authorization request nevertheless includes unrelated image, video, and music generation permissions. It also obtains wallet-spending, artifact-writing, and task-cancellation capabilities through one shared bearer credential. The command interface accepts an arbitrary `tool_name` and forwards it directly to the remote MCP server. There is no package-local allowlist restricting calls to the operations documented as necessary for this Skill. Consequently, the client does not enforce a least-privilege boundary between speech-related operations and other tools ...[truncated 1528 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the shared full scope with package-specific least-privilege authorization. Retain only permissions needed for: - Speech synthesis. - Voice listing and authorized voice cloning. - Explicitly selected asset uploads. - Model-card retrieval. - Task polling and user-requested cancellation. - Read-only wallet operations where requested by the user. 2. Remove `images:generate`, `videos:generate`, and `music:generate` from this Skill's authorization request. 3. Separate wallet-read privileges from wallet-spending privileges where the service supports that distinction. 4. Add a fixed allowlist in `_run_command` for the MCP tools required by this package. Reject every unrecognized tool before opening an authenticated session. 5. Apply operation-specific confirmation checks for billable, cloning, upload, cancellation, and other state-changing calls. 6. Prefer server-issued package-bound credentials so that a modified local client cannot use the token for unrelated tool families. 7. Add automated tests confirming that unrelated media tools and unknown tool names are rejected locally.