T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:33
- Finding
- Overprivileged shared credential permits unrelated paid operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:33-36`; `scripts/mcp_client.py:1459-1481` **Vulnerability Type**: Excessive OAuth scope and unrestricted MCP tool dispatch **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` The generic command handler accepts any tool name supplied on the command line and forwards it to the MCP service: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The declared Skill functionality is limited to creating and editing still images for product-launch boards, uploading selected reference images, reading model information, polling tasks, and reporting billing information. The authorization scope nevertheless includes unrelated capabilities for video, music, speech, and voice creation or modification. The bearer credential is shared across Beatra Skill packages and also includes `wallet:spend`. Consequently, the unnecessary media scopes are not merely informational permissions: they can authorize unrelated billable operations. The bundled client compounds this excessive scope by accepting an ar ...[truncated 1980 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope credential with a package-specific, least-privilege credential. 2. Limit this Skill to the capabilities actually required, such as: - Image generation and image editing. - Explicitly selected asset upload. - Model-card reads. - Task reads and user-requested cancellation. - Necessary wallet balance, ledger, and spending permissions. 3. Remove unrelated video, music, speech, and voice scopes. 4. Separate read-only wallet access from wallet-spending authorization where supported. 5. Add a local allowlist before `tools/call`. Reject every tool not explicitly required by this package, including newly introduced server tools. 6. Consider separate commands or explicit user confirmation for billable calls and task cancellation. 7. Make hostname collection optional, disclose it before authorization, and use a user-provided device label when possible. 8. Add automated tests confirming that unrelated MCP tools are rejected locally even when the remote credential would authorize them. ]]>