T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/ari.py:1206
- Finding
- Specialized Workflow and Focus Restrictions Can Be Overridden## Vulnerability Details **File Location**: `scripts/ari.py:1206-1209` and `scripts/ari.py:1687-1688` **Vulnerability Type**: Improper enforcement of specialized capability boundaries **Risk Level**: Medium ### Vulnerable Code ```python def operation_payload(args): defaults = operation_defaults() workflow = (getattr(args, "workflow", None) or defaults.get("workflow") or "").strip() focus = (getattr(args, "focus", None) or defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "运营工作流缺少 workflow/focus", "通用 Skill 请显式传 --workflow 和 --focus；专属 Skill 会内置固定值。") request_id = (getattr(args, "request_id", None) or "").strip() or str(uuid.uuid4()) return { "requestId": request_id, "workflow": workflow, "focus": focus, "asin": args.asin.upper(), "site": args.site or defaults.get("defaultSite") or "amz_us", "competitorAsin": (getattr(args, "competitor", None) or "").upper(), }, None ``` The specialized operations parser also exposes the override parameters: ```python def add_operation_args(parser, confirm=False): parser.add_argument("--asin", required=True) parser.add_argument("--site", default="amz_us", choices=SITES) parser.add_argument("--workflow") parser.add_argument("--focus") parser.add_argument("--competitor") parser.add_argument("--request-id", default="") if confirm: parser.add_argument("--confirm", action="store_true", help="确认按报价扣点并生成；未提供时只返回报价") ``` ### Technical Analysis This package declares an immutable specialized contract of `workflow=listing` and `focus=promise` in `skill-defaults.json`. Its documentation also states that the specialized entry point must not accept arbitrary workflows or prompts. However, `operation_payload()` gives command- ...[truncated 1964 chars]
- Remediation
- ## Remediation Suggestions 1. In specialized packages, always load `workflow` and `focus` exclusively from `skill-defaults.json`. 2. Remove `--workflow` and `--focus` from the specialized command-line parser. 3. If a shared parser must be retained, reject caller-supplied values unless they exactly equal the packaged defaults. 4. Add explicit checks immediately before both quote and run requests: ```python expected_workflow = defaults.get("workflow") expected_focus = defaults.get("focus") if getattr(args, "workflow", None) not in (None, "", expected_workflow): return None, error_obj( "ARI_SPECIALIZATION_VIOLATION", 403, "Workflow overrides are not allowed by this specialized Skill." ) if getattr(args, "focus", None) not in (None, "", expected_focus): return None, error_obj( "ARI_SPECIALIZATION_VIOLATION", 403, "Focus overrides are not allowed by this specialized Skill." ) workflow = expected_workflow focus = expected_focus ``` 5. Include the expected workflow and focus in the quote response and verify them again when executing the quoted request. 6. Add regression tests proving that alternate workflow/focus arguments are rejected even when the account capability response lists them as supported. 7. Consider enforcing the distribution channel and permitted workflow/focus combination on the server so a modified local client cannot exceed the specialized package's scope.