T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/authorize.py:31
- Finding
- OAuth Device Token Is Granted Capabilities Beyond the Skill's Functional Requirements<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:31-34` **Vulnerability Type**: Excessive OAuth scopes and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ### Technical Analysis The Skill's declared workflow requires uploading portrait and audio files, reading available models and voices, cloning voices, synthesizing speech, generating videos, reading and canceling tasks, and spending credits for approved operations. The authorization request additionally includes: - `images:generate` - `music:generate` - The broad `mcp:tools` capability Independent image generation and music generation are not part of the declared portrait-driven talking-avatar workflow. The broad MCP tool scope may also expose tools beyond those explicitly required by this Skill. The credential is described as a shared, full-scope Device Token used by multiple Beatra Skills. Consequently, unnecessary permissions increase the blast radius if the bearer token, the Skill, or another component using the shared credential is compromised. No evidence was found that the Skill currently invokes the unrelated image-generation or music-generation permissions. The vulnerability is the unnecessary authorization itself. ### Attack Path 1. The user runs `scripts/authorize.py`. 2. The user approves the complete scope set presented by the Beatra authorization service. 3. Beatra issues a bearer token containing the unrelated `images:generate` and `music:generate` capabilities. 4. An attacker obtains access to the token through a separate local compromise, malicious future update, or another component sharing the credential. 5. The attacker authenticates to Beatra using the token. 6. The attacker invokes unrelated image or music generation operatio ...[truncated 913 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove scopes unrelated to the declared workflow, particularly: - `images:generate` - `music:generate` 2. Replace `mcp:tools` with individual tool-specific or capability-specific scopes where the Beatra authorization service supports them. 3. Restrict the requested permissions to: - Artifact upload and read access. - Model discovery. - Voice listing and cloning. - Speech generation. - Video generation. - Required task read and user-requested cancellation operations. - Wallet spending and read-only billing access required for explicitly approved paid operations. 4. Prefer a package-specific credential over a full-scope credential shared by every installed Beatra Skill. 5. Make the authorization page clearly enumerate the exact capabilities being granted. 6. Add automated tests that compare the requested scopes against an explicit allowlist for this package and fail release validation if unrelated scopes are introduced. 7. If the backend cannot issue narrower credentials, document that limitation prominently and apply server-side authorization policies restricting this package identifier to its approved tool set. ]]>