T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/pod.py:118
- Finding
- Consent Layer Is Not Enforced by Pod Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pod.py:118-159`; related consent checks are defined in `consent.py:87-105` and `scripts/consent.py:132-150` **Vulnerability Type**: Missing authorization enforcement **Risk Level**: High ### Vulnerable Code ```python def query_pod(pod_name: str, text: str = None, sql: str = None): """Query a pod.""" pod_path = PODS_DIR / pod_name if not pod_path.exists(): print(f"Error: Pod '{pod_name}' not found") return False db_path = pod_path / "data.sqlite" conn = sqlite3.connect(db_path) c = conn.cursor() if sql: try: c.execute(sql) rows = c.fetchall() for row in rows: print(row) except Exception as e: print(f"SQL Error: {e}") elif text: # Simple text search c.execute("SELECT id, title, content, tags FROM notes WHERE content LIKE ? OR title LIKE ?", (f"%{text}%", f"%{text}%")) rows = c.fetchall() if rows: print(f"📄 Found {len(rows)} results for '{text}':") for row in rows: print(f" [{row[0]}] {row[1]}: {row[2][:80]}...") else: print(f"No results for '{text}'") else: c.execute("SELECT id, title, tags, created_at FROM notes") rows = c.fetchall() if rows: print(f"📄 Notes in '{pod_name}':") for row in rows: print(f" [{row[0]}] {row[1]} | {row[2]} | {row[3]}") else: print("No notes yet.") conn.close() return True ``` A consent-checking function exists separately: ```python def check(pod: str, agent: str) -> bool: grants = load_grants() key = f"{pod}:{agent}" if key not in grants: return False grant = grants[key] if not grant.get("active"): return False # Check expiration if grant.get("expires"): e ...[truncated 2264 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a single access gateway used by every operation that reads or modifies pod data. 2. Require an authenticated agent identifier and session identifier for query, add, ingest, search, list, export, import, and pack operations. 3. Before resolving or opening a pod, verify: - The session or grant exists. - The requesting agent matches the grant. - The requested pod is explicitly allowed. - The grant remains active and has not expired. 4. Deny access by default when identity or consent information is absent. 5. Consolidate the two consent implementations into one authoritative store and remove the unused implementation. 6. Route all accesses through mandatory audit logging, including denied attempts, operation type, pod, agent, session, timestamp, and result count. 7. Add integration tests proving that absent, revoked, expired, or wrong-pod grants are denied for every command. 8. Treat direct database helpers as internal functions and prevent CLI entry points from bypassing the gateway. ]]>