T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:32
- Finding
- Overbroad Device Authorization and Unrestricted Remote Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:32-36`; `scripts/mcp_client.py:1463-1482` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill is declared as a crowdfunding still-image generator, but its authorization request includes privileges for video, music, speech, voice creation and modification, general artifact writing, wallet spending, artifact and task reading, and task cancellation. The bundled MCP client compounds this excessive scope by accepting an arbitrary tool name from the command line and forwarding it through `tools/call`. There is no local allowlist restricting calls to the image-generation, image-editing, model-listing, upload, task-read, and billing operations needed by the declared workflow. Although the server may independently enforce token scopes and tool-specific authorization, the local implementation does not provide a package-level least-privilege boundary. ...[truncated 1305 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the full shared scope with the smallest set required by this Skill, limited to: - Image generation and editing. - Model-card reads. - Explicit reference-image upload. - Task reads for polling and recovery. - Narrow billing reads and the minimum spending permission required for approved generation. 2. Remove video, music, speech, voice-write, broad artifact, and task-cancel privileges unless a documented workflow requires each one. 3. Introduce a local exact-match allowlist for permitted tool names. 4. Reject every unrecognized tool before opening an authenticated session. 5. Separate task cancellation into an explicitly confirmed path if it must remain available. 6. Prefer package-specific tokens rather than a full-scope credential shared by multiple Skills. 7. Display the requested permissions to the user before beginning Device Authorization. 8. Add tests proving that unrelated tool names and scopes are rejected. ]]>