T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/ari.py:1169
- Finding
- Specialized Workflow Restrictions Can Be Bypassed Through CLI Overrides## Vulnerability Details **File Location**: `scripts/ari.py:1169-1171`, `scripts/ari.py:1200-1204`, and `scripts/ari.py:1641-1648` **Vulnerability Type**: Specialized workflow scope bypass **Risk Level**: Medium The specialized Skill declares an immutable `listing/conversion` workflow with the `ops_listing` output template. However, the CLI accepts user-controlled `--workflow` and `--focus` arguments and gives them precedence over the packaged defaults. Relevant code: ```python def operation_payload(args): defaults = operation_defaults() workflow = (getattr(args, "workflow", None) or defaults.get("workflow") or "").strip() focus = (getattr(args, "focus", None) or defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "运营工作流缺少 workflow/focus", "通用 Skill 请显式传 --workflow 和 --focus；专属 Skill 会内置固定值。") request_id = (getattr(args, "request_id", None) or "").strip() or str(uuid.uuid4()) return { "requestId": request_id, "workflow": workflow, "focus": focus, "asin": args.asin.upper(), "site": args.site or defaults.get("defaultSite") or "amz_us", "competitorAsin": (getattr(args, "competitor", None) or "").upper(), }, None ``` The subsequent contract check validates only whether the remote account supports the selected combination: ```python supported = False for item in data.get("workflows") or []: if (item.get("workflow") == payload["workflow"] and payload["focus"] in (item.get("focuses") or [])): supported = True break if not supported: return error_obj("ARI_INVALID_OPERATIONS_WORKFLOW", 422, "服务端不支持该 workflow/focus 组合", "先运行 operations capabilities 查看当前白名单。") ``` The override parameters are exposed by the parser: ```python ...[truncated 3313 chars]
- Remediation
- ## Remediation Suggestions 1. In this specialized distribution, always derive `workflow`, `focus`, and `outputTemplate` exclusively from `skill-defaults.json`. 2. Remove `--workflow` and `--focus` from the specialized CLI parser. If generic operation selection is required, publish it through a separately identified generic CLI or Skill. 3. If compatibility requires retaining these arguments, reject any supplied value that differs from the packaged contract: ```python expected_workflow = defaults.get("workflow") expected_focus = defaults.get("focus") if getattr(args, "workflow", None) not in (None, "", expected_workflow): return None, error_obj( "ARI_SPECIALIZED_SCOPE_VIOLATION", 403, "This specialized Skill only permits its packaged workflow.") if getattr(args, "focus", None) not in (None, "", expected_focus): return None, error_obj( "ARI_SPECIALIZED_SCOPE_VIOLATION", 403, "This specialized Skill only permits its packaged focus.") workflow = expected_workflow focus = expected_focus ``` 4. Validate the complete immutable tuple—`workflow`, `focus`, and `outputTemplate`—before both quote and run requests. 5. Include the expected output-template identifier in the request if the API supports it, and have the server reject mismatched specialized-channel requests. 6. Add regression tests proving that alternate workflow or focus arguments are rejected even when the authenticated account supports them. 7. Retain server-side capability checks as defense in depth, but do not rely on them to enforce the specialized Skill's narrower scope.