T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/authorize.py:31
- Finding
- Over-Privileged Device Token and Unrestricted MCP Tool Dispatch<![CDATA[ ## Vulnerability Details **File Location**: `scripts/authorize.py:31-35`; `scripts/mcp_client.py:1452-1469` **Vulnerability Type**: Excessive OAuth scope and missing tool allowlist **Risk Level**: High ### Vulnerable Code ```python SCOPE = ( "mcp:tools artifacts:write images:generate videos:generate music:generate " "speech:generate voices:read voices:write wallet:spend tasks:read artifacts:read tasks:cancel" ) ``` ```python def _run_command(command: str, tool_name: str | None = None) -> dict[str, Any]: session = _session_with_registration( state_dir=Path.home() / ".beatra", post_json=_default_post_json, ) if command == "tools": return session.request(2, "tools/list", {}) try: arguments = json.load(os.sys.stdin) except json.JSONDecodeError as exc: raise RuntimeError("Tool arguments on stdin must be one JSON object") from exc if not isinstance(arguments, dict): raise RuntimeError("Tool arguments on stdin must be one JSON object") assert tool_name is not None return session.request( 2, "tools/call", {"name": tool_name, "arguments": arguments}, ) ``` ### Technical Analysis The authorization helper requests a shared bearer token with broad capabilities, including wallet spending, task cancellation, music generation, image generation, voice creation, and general MCP tool access. Some of these permissions are unrelated to the declared caption-to-talking-video workflow. The command dispatcher then accepts an arbitrary `tool_name` and forwards it to `tools/call`. It does not enforce a package-specific allowlist. Consequently, the effective boundary is the broad server-issued token rather than the Skill’s declared functionality. This violates least privilege. Even if the broad token is intentionally shared by multiple Beatra packages, this Skill can use that credential to invoke operations beyond its own legitimate requirements. ### Attac ...[truncated 1064 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the shared full-scope credential with a package-specific token carrying only the permissions required by this Skill. 2. Remove unrelated permissions such as music generation and any other capabilities not used by the declared workflow. 3. Implement a strict local allowlist for permitted tool names, including only the required model, caption, upload, voice, speech, video, task, wallet-read, and installation-registration operations. 4. Enforce the same allowlist server-side so bypassing the bundled client does not restore excessive access. 5. Separate read-only wallet access from wallet spending privileges. 6. Require explicit, operation-specific user confirmation for task cancellation and billable operations. 7. Avoid sharing one broadly privileged token across packages with materially different functionality. 8. Add automated tests proving that unknown or unrelated MCP tool names are rejected before any network request is made. ]]>