T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- executor.py:76
- Finding
- Unrestricted Dispatch of MCP Tools Beyond the Declared Skill Interface<![CDATA[ ## Vulnerability Details **File Location**: `executor.py:76-77` and `executor.py:130-134` **Vulnerability Type**: Missing authorization and tool allowlist enforcement **Risk Level**: Medium ### Complete Code Snippet ```python async def call_tool(self, tool_name: str, arguments: dict): """Execute a tool call.""" if not self.session: await self.connect() response = await self.session.call_tool(tool_name, arguments) return response.content ``` ```python elif args.call: call_data = json.loads(args.call) result = await executor.call_tool( call_data["tool"], call_data.get("arguments", {}) ) ``` ### Technical Analysis The executor accepts an arbitrary tool name from the JSON supplied through `--call` and forwards it directly to the connected MCP server. It does not verify that the requested tool belongs to the 22-tool interface declared in `SKILL.md`. Consequently, the documented Skill interface is not an enforced security boundary. If the locally installed MCP server exposes additional tools—whether through a server update, configuration change, or another implementation at the configured executable path—those tools can be invoked through this executor. The executor also does not apply local confirmation or authorization controls to sensitive declared operations such as remote command execution, port forwarding, device shutdown, and remote desktop input. Although the MCP server may independently enforce access controls, no such guarantee is implemented by this project. ### Attack Path 1. An attacker influences an agent instruction or otherwise causes a crafted `--call` JSON value to be passed to `executor.py`. 2. The crafted value names an undeclared or unexpectedly privileged tool exposed by the installed MCP server. 3. `executor.py` parses the attacker-influenced tool name without checking it against an allowlist. 4. `MCPExecutor.call_tool()` forwards the name and arguments directly through `ses ...[truncated 971 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define an explicit immutable allowlist containing only the tools documented and approved for this Skill. 2. Reject tool names not present in that allowlist before calling `session.call_tool()`. 3. Validate every arguments object against a locally maintained JSON Schema, including types, bounds, enumerations, and required fields. 4. Add mandatory interactive confirmation for high-impact operations, including: - Remote command execution - Port-forwarding changes - Device shutdown or removal - Clipboard and keyboard input - Remote desktop control 5. Consider separating read-only and state-changing capabilities into different execution modes. 6. Log the requested tool, target device or session, confirmation result, and outcome without recording credentials or sensitive command output. 7. Treat server-side authorization as defense in depth rather than a replacement for client-side least-privilege enforcement. ]]>