T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:30
- Finding
- Overprivileged Shared Bearer Token Combined with Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:30-34`; `scripts/mcp_client.py:1485-1504` **Vulnerability Type**: Excessive authorization scope and missing local tool allowlist **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The Skill is designed to upload authorized media, synthesize or clone speech, create image-to-video clips, inspect models, read billing information, and monitor associated tasks. However, authorization requests a shared token with substantially broader permissions, including: - Generic MCP tool access - Image generation - Music generation - Broad artifact read and write access - Wallet spending - Task cancellation Some of these permissions, particularly music generation and generic image generation, are not required for the declared job-fair talking-clip workflow. Task cancellation is only conditionally relevant and shoul ...[truncated 2325 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Issue a package-specific least-privilege token** - Remove `music:generate` and unrelated `images:generate` access. - Limit artifact permissions to artifacts created or explicitly selected for this workflow. - Split task cancellation from ordinary task-read access. - Avoid a generic `mcp:tools` grant when individual tool grants are available. 2. **Add a strict local tool allowlist** Permit only the operations required by the declared workflow, such as: - `beatra.assets.upload` - `beatra.models.list` - `beatra.voices.list` - `beatra.voices.clone` - `beatra.speech.synthesize` - `beatra.videos.animate` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.wallet.get` - `beatra.wallet.ledger` - `beatra.installations.register` Reject every other tool name before initializing a privileged session. 3. **Separate sensitive capabilities** - Require explicit user confirmation immediately before task cancellation. - Use a separate, short-lived spending grant for paid generation. - Keep read-only wallet and task operations on a read-only credential where feasible. 4. **Enforce restrictions server-side** A local allowlist is defense in depth, not a substitute for server-side authorization. The service should bind tokens to the package identity and reject unrelated tool calls even if a modified client submits them. 5. **Audit and log tool identity safely** Record the invoked tool name, package identifier, and request identity without recording bearer tokens or sensitive prompt contents. ]]>