T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/authorize.py:34
- Finding
- Overprivileged Device Token and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; `scripts/mcp_client.py:1463-1481`; `scripts/mcp_client.py:1490` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: Medium ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call.add_argument("tool_name") ``` ### Technical Analysis The Skill's declared workflow needs image generation, speech synthesis, video generation, artifact access, model and voice discovery, wallet reads, and task management. The requested authorization scope also includes unrelated capabilities such as `music:generate` and `voices:write`. In addition, the command-line client accepts an arbitrary MCP tool name and forwards it using the shared bearer credential. It does not enforce an allowlist corresponding to the operations documented by this Skill. Server-side scope checks may limit some calls, but every capability present in the broad token remains available through this generic dispatch path. This violates least-privilege principles ...[truncated 1459 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope token with a package-specific, least-privilege credential. 2. Remove capabilities not required by this Skill, particularly `music:generate` and `voices:write`. 3. Define an explicit client-side allowlist containing only documented tools, such as: - `beatra.models.list` - `beatra.voices.list` - `beatra.images.generate` - `beatra.speech.synthesize` - `beatra.videos.animate` - Required artifact, wallet, installation, and task operations 4. Reject unknown tool names before initializing an authenticated session. 5. Separate read-only, spending, cancellation, and resource-modification permissions where supported. 6. Require explicit user confirmation immediately before wallet spending, task cancellation, or mutable account operations. 7. Avoid sharing one unrestricted token across unrelated Skills; use capability-bound or audience-bound tokens instead. 8. Enforce equivalent restrictions server-side because client-side allowlists alone can be bypassed by a modified client. ]]>