T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/authorize.py:34- Finding
Overprivileged Shared Device Token Permits Unrelated Paid and Write Operations
- Content
View full analysis
Vulnerability Details
File Location:
scripts/authorize.py:34-37
Vulnerability Type: Excessive authorization scope and failure to enforce least privilege
Risk Level: HighThe Skill requests a full-scope bearer credential that includes image, video, speech, and voice-management permissions unrelated to its declared retail music-playlist functionality.
Vulnerable Code
python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" )The generic command dispatcher at
scripts/mcp_client.py:1474-1489also accepts any caller-supplied MCP tool name without a package-specific allowlist:python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, )Technical Analysis
The declared functionality requires music generation, model discovery, task status and cancellation, artifact retrieval, and billing-related access. It does not require image generation, video generation, speech generation, or voice read/write privileges.
The authorization process nevertheless obtains a shared bearer token containing all of these capabilities. The documentation confirms tha ...[truncated 2044 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the shared full-scope credential with a package-specific or capability-specific token.
- Limit authorization scopes to those required by this Skill, such as music generation, model discovery, task read/cancel, artifact retrieval, and explicitly approved wallet spending.
- Remove
images:generate,videos:generate,speech:generate,voices:read, andvoices:writeunless a user explicitly enables functionality that requires them. - Add a strict local allowlist in
mcp_client.pyfor this package, including only the documented operations:beatra.models.listbeatra.music.generatebeatra.tasks.getbeatra.tasks.listbeatra.tasks.cancelbeatra.wallet.getbeatra.wallet.ledgerbeatra.installations.register- Any narrowly required artifact retrieval operation
- Reject unknown tool names before establishing a credential-backed session.
- Separate read-only, billable, and resource-modifying capabilities. Require explicit user authorization before upgrading from read-only access to wallet-spending access.
- Enforce the same package and capability restrictions server-side so bypassing the bundled client cannot expose unrelated tools.
- Migrate existing full-scope credentials by revoking them and issuing reduced-scope replacements after clear user consent.