T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:33
- Finding
- Overprivileged OAuth Scope and Unrestricted Remote Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:33-37`; `scripts/mcp_client.py:1462-1479` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: High ### Complete Code Snippets ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared purpose is to create a set of still KYC guide images. Its documented workflow requires image generation and editing, model discovery, optional artifact upload, task inspection and recovery, and read-only billing information. The requested OAuth scope is substantially broader. It includes video, music, speech, voice write/read, unrestricted artifact writes, wallet spending, and task cancellation. The bundled client also accepts an arbitrary tool name from the command line and forwards it to the remote MCP service without enforcing a package-specific allowlist. The remote service may still perform its own authorization and schema checks, but the local client does not preserve the Skill's least-privilege boundary. A bearer token obtained for this image-oriented Skill is capable of authorizing unrelated operations. ### Attack Path 1. A user authorizes the KYC image Skill. 2. The authorization helper obtains a bearer token with the complete broad scope. 3. A malicious instruction, compromised future package update, or accidental command invokes: `python3 scrip ...[truncated 800 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared broad scope with a package-specific minimum scope containing only: - image generation and editing; - model listing; - narrowly required artifact upload/read access; - read-only wallet access; - task read access; and - task cancellation only if cancellation is an explicitly supported user operation. 2. Remove video, music, speech, and voice permissions from this Skill. 3. Separate wallet spending from general tool authorization where the service supports granular scopes. 4. Add a hardcoded local allowlist in `_run_command`, for example: - `beatra.models.list` - `beatra.images.generate` - `beatra.images.edit` - `beatra.assets.upload` - `beatra.tasks.get` - `beatra.tasks.list` - `beatra.tasks.cancel` - `beatra.wallet.get` - `beatra.wallet.ledger` 5. Reject every unrecognized tool before creating an MCP request. 6. Use separate credentials per package or capability if the Beatra platform cannot issue sufficiently narrow shared tokens. 7. Add automated tests proving that unrelated media, voice, and wallet-spending tools are rejected locally. ]]>