T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:9- Finding
Missing Authorization Controls for Sensitive Database Queries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:9-15, 20-26, 50-58
Vulnerability Type: Missing authorization and least-privilege enforcement
Risk Level: HighComplete Relevant Snippet
markdown 2. **Locate Collection**: Based on business knowledge, which collection does the request involve? (For example, references to “replies/messages” must use `Whisper_Mail`.) 3. **Verify Structure**: Do I know the collection's current field names and data types? - **Mandatory requirement**: Unless it is an extremely simple single-table `query_*` operation with exactly matching parameters, the **first tool must be** `inspect_collection_sample`. - **Do not guess from experience**: Even when documentation describes the structure, use `inspect` to verify the live environment.markdown 3. **Security Boundary**: - Default `limit` is 20, with a maximum of 100. - Unless the user explicitly requests “details,” do not output complete documents (avoid `$push: "$$ROOT"`).markdown - **Murmur system**: `Whisper` (primary table), `Whisper_Mail` (replies/messages/private messages), `Whisper_Raw` (raw data/public status). - **Achievements/activities**: `Achievement` and `history`, `Gift` (activity details in the `content` field), `Gift_Codes` (gift codes, joined through `activity_name`). - **Content collections**: `Contribute_Article`, `Goods_Collection`, `Goods_Collection_Cards`. - **System configuration**: `Option_Global` (platform), `Option_User` (user settings). - **User wallets**: `CatLab_Wallet` (user wallet), `CatLab_Wallet_History` (user redemption records).The excerpts above are faithful English renderings of the corresponding Chinese instructions in the audited file.
Technical Analysis
The Skill instructs the agent to inspect live MongoDB collection schemas and query collections containing private messages, user settings, wallet balances, redemption histories, and gift codes. However, it does not require authent ...[truncated 2430 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require authenticated identity before database access
- Bind every tool invocation to a verified user and tenant identity.
- Reject sensitive queries from anonymous or unverifiable callers.
-
Enforce authorization server-side
- Apply role-based or attribute-based authorization in the database gateway rather than relying solely on agent instructions.
- Define explicit collection and operation allowlists for each role.
- Deny access by default.
-
Apply mandatory ownership and tenant filters
- Automatically constrain private-message, settings, wallet, and history queries to the authenticated user's records.
- Ensure callers cannot remove or override these predicates through natural-language requests or aggregation pipelines.
-
Restrict highly sensitive collections
- Prohibit general-purpose access to unclaimed gift codes.
- Expose gift-code operations through a dedicated redemption service that returns only success or failure, not raw codes.
- Restrict wallet and private-message access to narrowly scoped business functions.
-
Introduce field-level controls
- Redact message bodies, redeemable codes, internal identifiers, and financial fields unless explicitly required and authorized.
- Return aggregated or masked results wherever possible.
-
Constrain schema-inspection and aggregation tools
- Prevent schema sampling from exposing sensitive values.
- Validate aggregation pipelines against an allowlist of permitted stages, collections, fields, and mandatory filters.
- Disallow unrestricted joins that can bypass access boundaries.
-
Add auditing and abuse detection
- Log the authenticated principal, purpose, collections, filters, fields, result count, and authorization decision for each operation.
- Alert on bulk access, cross-user lookups, gift-code enumeration, and repeated denied requests.
-
Test authorization boundaries
- Add negative tests ...[truncated 221 chars]
-