T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:142- Finding
Unbounded Collection of Employee and Project Metadata
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 142–148
Vulnerability Type: Excessive database access beyond the stated reporting scope
Risk Level: MediumVulnerable Code
python cursor.execute("SELECT id, name FROM zt_product") cursor.execute("SELECT id, name, project FROM zt_execution") cursor.execute("SELECT account, realname FROM zt_user")Technical Analysis
The skill is intended to analyze one specified user over a specified time range. However, these queries retrieve every product, execution, user account, and real name available to the configured database account. They contain no filtering based on the target user, relevant work-item identifiers, authorized organizational scope, or requested reporting period.
This violates data-minimization and least-privilege principles. The issue is particularly sensitive for
zt_user, because it exposes the identity directory of unrelated employees even when only one employee is being analyzed. Although the documented database account is read-only, read-only access does not prevent unauthorized disclosure or excessive collection.Attack Path
- An operator activates the skill and supplies a target user and reporting period.
- The skill connects to the Zentao database using the configured read-only account.
- During preliminary mapping, it executes the unfiltered queries.
- The database returns all accessible user identities, products, and execution metadata rather than only records associated with the requested report.
- The unrelated information is loaded into the agent context and may be retained in logs, intermediate state, or generated output.
- A user able to invoke the skill could consequently obtain organizational metadata outside the legitimate scope of the report, subject to the database account's existing SELECT permissions.
Impact Assessment
The issue does not grant database write access, operating-system ...[truncated 623 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace database-wide mapping queries with queries restricted to identifiers referenced by the selected user's in-scope work records.
- Query only the selected user's identity directly:
python cursor.execute( "SELECT account, realname FROM zt_user WHERE account = %s", (user,) ) - Build the relevant product and execution ID sets from the already authorized story, task, and bug results, then use parameterized
INqueries to retrieve only those mappings. - Apply the requested time range when identifying relevant actions and work objects before loading metadata.
- Configure a dedicated database role that can read only the required columns and tables. Where practical, expose restricted database views rather than granting access to complete tables.
- Add explicit authorization checks for the target employee and organizational scope before issuing queries.
- Avoid including unrelated mapping data in reports, logs, exceptions, or agent context, and securely delete intermediate data after report generation.
- Add tests that fail if a single-user report executes an unfiltered query against
zt_user,zt_product, orzt_execution.