T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/tools.py:42- Finding
Unrestricted Client-Supplied SQL Is Forwarded to the Database Service
- Content
View full analysis
Dict[str, Any]: """ MCP Tool to execute a SQL query. Args: query: A SQL query string provided by the client. Returns: JSON-formatted query results as a string or an error message. """ arguments = { "query": query } return call_api("1819483683233802", "sql_query", arguments) ``` ### Technical Analysis The `sql_query` function accepts an arbitrary SQL string and forwards it directly to the remote MCP database service. The code does not restrict the query to read-only operations, enforce a single statement, allowlist accessible schemas or tables, impose a result limit, or reject data-definition and data-modification statements. This capability also exceeds the Skill's stated database-metadata purpose. Although the final behavior depends on validation and database privileges configured by the remote service, this client establishes no least-privilege boundary of its own. If the upstream service executes queries under a role with write or administrative permissions, the caller may be able to access or alter resources beyond metadata retrieval. ### Attack Path 1. A user or attacker supplies a malicious query through the Skill's `sql_query` capability. 2. The agent passes the query to `scripts.tools.sql_query`. 3. The function places the unmodified query in the API request body. 4. `call_api` transmits it to the remote `sql_query` tool. 5. If the upstream database role permits the requested operation, the statement executes with that role's privileges. 6. The attacker may retrieve unauthorized records, alter or delete data, change database objects, or consume database resources. Example classes of dangerous input include unr ...[truncated 667 chars]- Remediation
View remediation