T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:34
- Finding
- Overprivileged Device Authorization and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:34-37`; `scripts/mcp_client.py:1445-1464`; `scripts/mcp_client.py:1490-1491` **Vulnerability Type**: Excessive authorization scope and missing tool allowlist **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ```python call = subparsers.add_parser("call", help="Call one tool with a JSON object on stdin") call.add_argument("tool_name") ``` ### Technical Analysis The authorization flow requests broad permissions including image generation, music generation, wallet spending, artifact access, and task cancellation. Some of these capabilities are unrelated to the declared Xiaohongshu policy talking workflow. The command dispatcher accepts an arbitrary tool name from the command line and forwards it to the remote MCP service using the shared bearer credential. It does not enforce a package-specific allowlist or distinguish read-only operations from paid, destructive, or privilege-sensitive operations. Consent requirements are documented in `SKILL.md`, but ...[truncated 1503 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the broad shared scope with the minimum permissions required by this Skill. 2. Remove unrelated permissions such as `images:generate` and `music:generate` unless a documented workflow requires them. 3. Separate read-only, upload, paid-generation, spending, and cancellation capabilities into independently authorized scopes. 4. Implement a hardcoded local allowlist containing only the required Beatra tools, such as the specifically documented model, social lookup, upload, speech, voice, video, task, and wallet operations. 5. Reject unknown tool names before creating an MCP request. 6. Enforce explicit confirmation for paid or destructive operations in executable code rather than relying exclusively on natural-language instructions. 7. Consider using a separate package-specific credential instead of a shared full-scope device token. 8. Add tests proving that unrelated generation tools, cancellation operations, and unknown future tools are rejected locally. ]]>