T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:35
- Finding
- Overprivileged Shared Credential and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:35-39`; `scripts/mcp_client.py:1463-1482` **Vulnerability Type**: Violation of least privilege through excessive OAuth scopes and unrestricted tool selection **Risk Level**: High ### Complete Code Snippets `scripts/authorize.py:35-39`: ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` `scripts/mcp_client.py:1463-1482`: ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The Skill's declared workflow requires public Xiaohongshu note access, selected asset uploads, image generation or editing, task status reads, and billing information. The requested credential additionally grants unrelated capabilities for video, music, speech, and voice generation or modification. The credential is shared through `~/.beatra/credentials.json`. Although the implementation protects that file with restrictive POSIX permissions and transmits it only to a fixed HTTPS MCP endpoint, the authorization itself remains substantially broader than this Skill's legitimate requirements. The bundled client compounds this issue by accepting an arbitr ...[truncated 2002 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope credential with a package-specific credential containing only the capabilities required by this Skill. 2. Remove unrelated scopes, including video, music, speech, and voice generation or modification. 3. Separate read-only task and billing access from spending privileges where the service supports granular scopes. 4. Implement a package-local allowlist in `_run_command()`. Permit only the documented operations, such as the required model, social lookup, image, asset, task, wallet, and installation-registration calls. 5. Reject unknown tool names before creating an authenticated MCP session. 6. Consider separate explicit execution paths for paid operations, task cancellation, and read-only operations. 7. Enforce equivalent package-level restrictions on the server so bypassing the bundled client cannot restore broad access. 8. Add automated tests confirming that unrelated media, voice, administrative, or cancellation tools are rejected locally. ]]>