T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/authorize.py:32- Finding
Overly Broad Device Authorization Scope and Unrestricted MCP Tool Dispatch
- Content
View full analysis
Vulnerability Details
File Location:
scripts/authorize.py:32-35;scripts/mcp_client.py:1463-1483
Vulnerability Type: Excessive authorization scope and missing tool allowlist
Risk Level: HighVulnerable Code
scripts/authorize.py:32-35:python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" )scripts/mcp_client.py:1463-1483:python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, )Technical Analysis
The Skill is declared as a policy-digest image-generation workflow. Its legitimate operations include image generation and editing, model lookup, user-approved media upload, task status retrieval, and billing-related reads. However, the requested bearer-token scope additionally includes video generation, music generation, speech generation, voice creation and modification, wallet spending, and task cancellation.
The bundled client compounds this excessive privilege by forwarding any caller-supplied MCP tool name. There is no package-local allowlist that restricts calls to the tools documented for this Skill. Consequently, enforcemen ...[truncated 1639 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the shared broad scope with a package-specific least-privilege scope containing only the capabilities required by this Skill.
- Remove video, music, speech, voice-write, and task-cancellation permissions unless a concrete documented operation requires them.
- Separate read-only wallet access from spending authority. Do not grant general
wallet:spendpermission merely to display prices or ledger information. - Add an explicit local allowlist in
_run_command, covering only documented tools such as the required model, image, task-read, wallet-read, installation-registration, and upload operations. - Reject unknown tool names before establishing a session or reading the credential.
- Where different Beatra packages require different capabilities, issue separate package-bound credentials rather than sharing one full-scope token.
- Enforce the same package-to-tool authorization mapping on the server so bypassing the local client cannot recover the excessive capabilities.
- Add automated tests confirming that unrelated paid tools, voice-write operations, and cancellation calls are denied.