T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/ari.py:1205
- Finding
- Specialized Workflow Restrictions Can Be Overridden Through CLI Arguments## Vulnerability Details **File Location**: `scripts/ari.py`, lines 1205-1222 **Vulnerability Type**: Specialized workflow scope bypass **Risk Level**: Medium The Skill declares that its specialized operations entry point is restricted to the fixed `audit/action` workflow and must not accept arbitrary workflow or focus values. However, command-line values take precedence over the immutable defaults: ```python def operation_payload(args): defaults = operation_defaults() workflow = (getattr(args, "workflow", None) or defaults.get("workflow") or "").strip() focus = (getattr(args, "focus", None) or defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "运营工作流缺少 workflow/focus", "通用 Skill 请显式传 --workflow 和 --focus；专属 Skill 会内置固定值。") request_id = (getattr(args, "request_id", None) or "").strip() or str(uuid.uuid4()) return { "requestId": request_id, "workflow": workflow, "focus": focus, "asin": args.asin.upper(), "site": args.site or defaults.get("defaultSite") or "amz_us", "competitorAsin": (getattr(args, "competitor", None) or "").upper(), }, None ``` The parser also exposes `--workflow` and `--focus` for specialized operations commands: ```python def add_operation_args(parser, confirm=False): parser.add_argument("--asin", required=True) parser.add_argument("--site", default="amz_us", choices=SITES) parser.add_argument("--workflow") parser.add_argument("--focus") parser.add_argument("--competitor") parser.add_argument("--request-id", default="") ``` ### Technical Analysis The project configuration fixes the permitted workflow to `audit` and the focus to `action`: ```json { "workflow": "audit", "focus": "action", "outputTemplate": "ops_audit" } ``` Nevertheless, `operation_payl ...[truncated 2409 chars]
- Remediation
- ## Remediation Suggestions 1. Enforce package defaults for specialized builds: ```python def operation_payload(args): defaults = operation_defaults() workflow = str(defaults.get("workflow") or "").strip() focus = str(defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "This specialized Skill is missing fixed workflow settings." ) if getattr(args, "workflow", None) or getattr(args, "focus", None): return None, error_obj( "ARI_SPECIALIZED_WORKFLOW_OVERRIDE_BLOCKED", 0, "This Skill does not permit workflow or focus overrides." ) ``` 2. Do not register `--workflow` or `--focus` for specialized Skill distributions. Maintain a separate parser or build flag for the generic CLI if generic workflow selection is required elsewhere. 3. Validate all package-level constraints before making capability, quote, or run requests: - Require `workflow == "audit"`. - Require `focus == "action"`. - Require the expected output template to be `ops_audit`. - Reject mismatches locally before loading the API key where practical. 4. Include the expected Skill channel or template identifier in the quote and run contract, and have the server verify that the selected workflow is valid for that channel. 5. Add regression tests proving that: - Omitting workflow arguments produces `audit/action`. - Passing any other workflow or focus is rejected. - A server-advertised but package-disallowed combination remains rejected. - The run request exactly matches the fixed package configuration and the previously quoted request.