T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:550- Finding
Published Projects Expose Privileged MCP Tools Without Authentication
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:550-586
Supporting Location:wodeapp-ai-skill.json:70-76
Vulnerability Type: Missing authentication and insufficient authorization
Risk Level: HighVulnerable Code Snippet
markdown ### 3. Project-Level MCP (Per-Project, No Auth Needed) Each published project exposes its own MCP server at its subdomain. The AI Agent connects and **auto-discovers** all project capabilities — data CRUD, workflows, AI, TTS, video, and digital human. ```json { "mcpServers": { "my-project": { "type": "sse", "url": "https://my-project.wodeapp.ai/mcp" } } }Auto-discovered tools per project:
Category Tools Description Data CRUD query_{col}/create_/update_/delete_Auto-generated from project collections Workflows run_workflow_{id}+get_workflow_status+get_workflow_schemaAuto-extracted with input schemas, model override, wait-for-result AI ai_chat/ai_generate_image/ai_generate_jsonText, image, JSON generation TTS tts_generate/tts_list_voicesText-to-speech with voice selection Video video_task_create/video_task_status/video_providersUnified Video API (replaces kling_*) Digital Human kling_avatarPortrait + audio → talking head video Custom Components component_create/component_list/component_get/component_deleteAI-generate React components on demand Feishu Chat feishu_send/feishu_send_card/feishu_list_chatsSend messages/cards to Feishu groups Feishu Bitable feishu_bitable_list_tables/feishu_bitable_list_records/feishu_bitable_create_record/feishu_bitable_update_record/feishu_bitable_searchCRUD on Feishu spreadsheet data Feishu Docs feishu_doc_create/feishu_doc_readCreate and read Feishu documents WeCom wecom_send/wecom_send_image/ `wecom_...[truncated 3920 chars] - Remediation
View remediation
Remediation Suggestions
- Require authentication for every project MCP and workflow request. A project subdomain must never serve as the sole authorization mechanism.
- Issue project-scoped credentials or short-lived signed capability tokens with explicit audience, project, tool, action, and expiration claims.
- Enforce server-side authorization independently for every tool invocation rather than relying only on authentication at the MCP connection layer.
- Apply least-privilege scopes, separating permissions such as:
- Data read, create, update, and delete.
- Workflow discovery and execution.
- AI or media generation.
- Page and component modification.
- Enterprise messaging.
- Document and organizational-directory access.
- Disable mutation, messaging, organizational-data, and billable-generation tools for anonymous or public access by default.
- Make public sharing opt-in and restrict shared capabilities to explicitly selected read-only tools or workflows.
- Protect
/mcp/toolsand workflow-schema endpoints when their output reveals private collections, workflow structure, actions, or integrations. - Add per-project rate limits, spending limits, execution quotas, audit logs, anomaly detection, and immediate token revocation.
- Require additional confirmation or stronger authorization for destructive operations, external messaging, and high-cost generation.
- Review existing published projects and rotate or revoke associated access capabilities after authentication is introduced.