T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/ari.py:1168
- Finding
- Specialized Workflow Boundary Can Be Overridden## Vulnerability Details **File Location**: `scripts/ari.py:1168-1170` and `scripts/ari.py:1643-1646` **Vulnerability Type**: Least-privilege and scope-enforcement failure **Risk Level**: Medium ### Vulnerable Code ```python def operation_payload(args): defaults = operation_defaults() workflow = (getattr(args, "workflow", None) or defaults.get("workflow") or "").strip() focus = (getattr(args, "focus", None) or defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "运营工作流缺少 workflow/focus", "通用 Skill 请显式传 --workflow 和 --focus；专属 Skill 会内置固定值。") ``` ```python def add_operation_args(parser, confirm=False): parser.add_argument("--asin", required=True) parser.add_argument("--site", default="amz_us", choices=SITES) parser.add_argument("--workflow") parser.add_argument("--focus") parser.add_argument("--competitor") parser.add_argument("--request-id", default="") ``` ### Technical Analysis This package declares a specialized, immutable operations contract of `page_compare/entry`. The contract is documented in `SKILL.md:235-242` and `references/operation-workflow.md:3`, which state that the workflow and focus must come from `skill-defaults.json` and must not be changed to another focus or arbitrary workflow. The implementation does not enforce that boundary. In `operation_payload`, command-line values take precedence over the packaged defaults: ```python getattr(args, "workflow", None) or defaults.get("workflow") ``` The same precedence applies to `focus`. Because both values are exposed as command-line arguments, a caller can replace the specialized values before the request is submitted. The subsequent capability check only verifies that the selected workflow and focus are enabled for the ARI account. It does not verify that they are authorized for this particular s ...[truncated 2182 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--workflow` and `--focus` from specialized builds. The specialized CLI should load these values exclusively from `skill-defaults.json`. 2. If the arguments must remain for a shared implementation, reject any values that differ from the packaged contract: ```python defaults = operation_defaults() fixed_workflow = str(defaults.get("workflow") or "").strip() fixed_focus = str(defaults.get("focus") or "").strip() supplied_workflow = str(getattr(args, "workflow", None) or "").strip() supplied_focus = str(getattr(args, "focus", None) or "").strip() if supplied_workflow and supplied_workflow != fixed_workflow: return None, error_obj( "ARI_SPECIALIZED_WORKFLOW_OVERRIDE_BLOCKED", 403, "This specialized Skill does not permit workflow overrides." ) if supplied_focus and supplied_focus != fixed_focus: return None, error_obj( "ARI_SPECIALIZED_FOCUS_OVERRIDE_BLOCKED", 403, "This specialized Skill does not permit focus overrides." ) ``` 3. Distinguish specialized packages from a generic CLI using an explicit immutable build flag or package type. Permit workflow/focus arguments only in verified generic builds. 4. Include the package slug, channel, fixed workflow, fixed focus, and expected output template in quote and execution requests. Enforce the same contract server-side so a modified local client cannot broaden the package scope. 5. Validate that the quote response and execution request retain the exact fixed workflow, focus, request ID, and output template. Abort if any field differs. 6. Add regression tests confirming that: - Omitted values resolve to `page_compare/entry`. - Alternate `--workflow` values are rejected. - Alternate `--focus` values are rejected. - Quote and run requests use identical fixed contract fields. - Account-level ...[truncated 83 chars]