T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/ari.py:1206
- Finding
- Specialized Workflow Restrictions Can Be Overridden Through CLI Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py:1206-1223` **Vulnerability Type**: Specialized workflow restriction bypass **Risk Level**: Medium ### Code Snippet ```python def operation_payload(args): defaults = operation_defaults() workflow = (getattr(args, "workflow", None) or defaults.get("workflow") or "").strip() focus = (getattr(args, "focus", None) or defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "运营工作流缺少 workflow/focus", "通用 Skill 请显式传 --workflow 和 --focus；专属 Skill 会内置固定值。") request_id = (getattr(args, "request_id", None) or "").strip() or str(uuid.uuid4()) return { "requestId": request_id, "workflow": workflow, "focus": focus, "asin": args.asin.upper(), "site": args.site or defaults.get("defaultSite") or "amz_us", "competitorAsin": (getattr(args, "competitor", None) or "").upper(), }, None ``` The packaged defaults declare a fixed specialized contract: ```json { "workflow": "audit", "focus": "launch", "outputTemplate": "ops_audit" } ``` ### Technical Analysis The Skill documentation states that this specialized distribution must use the fixed `audit/launch` workflow and must not accept an arbitrary workflow or focus. However, `operation_payload()` gives caller-controlled `args.workflow` and `args.focus` precedence over the packaged defaults. The later `operation_contract()` validation only verifies that the selected combination is supported by the remote account. It does not verify that the combination is the one authorized for this specialized Skill. Consequently, any alternative workflow exposed by the server to the account can be selected through the CLI. This breaks the package-level least-privilege boundary: the specialized Skill advertises a narrow launch-readiness operation but exposes the broader remote operations interface. ### ...[truncated 1433 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. In specialized builds, load `workflow` and `focus` exclusively from `skill-defaults.json`. 2. Reject explicit CLI values that differ from the packaged contract: ```python def operation_payload(args): defaults = operation_defaults() fixed_workflow = str(defaults.get("workflow") or "").strip() fixed_focus = str(defaults.get("focus") or "").strip() supplied_workflow = str(getattr(args, "workflow", None) or "").strip() supplied_focus = str(getattr(args, "focus", None) or "").strip() if supplied_workflow and supplied_workflow != fixed_workflow: return None, error_obj( "ARI_SPECIALIZED_WORKFLOW_LOCKED", 403, "This specialized Skill does not permit workflow overrides." ) if supplied_focus and supplied_focus != fixed_focus: return None, error_obj( "ARI_SPECIALIZED_FOCUS_LOCKED", 403, "This specialized Skill does not permit focus overrides." ) workflow = fixed_workflow focus = fixed_focus ``` 3. Prefer omitting `--workflow` and `--focus` from the specialized build’s argument parser entirely. 4. Add tests proving that alternate server-supported combinations are rejected locally. 5. Enforce the package channel and fixed workflow contract on the server as defense in depth. 6. Bind the quoted `requestId` to the exact workflow, focus, ASIN, site, price, and package channel, and reject modified execution requests. ]]>