T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/permission_manager.py:108
- Finding
- Authorization Controls Can Be Bypassed for Role Assignment and Workflow Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/permission_manager.py:108-198`; related unenforced workflow operations in `scripts/workflow_engine.py:139-355` **Vulnerability Type**: Missing authorization checks and privilege escalation **Risk Level**: High ### Vulnerable Code `scripts/permission_manager.py:108-154` ```python def create_user( self, user_id: str, name: str, role: UserRole = UserRole.MEMBER, team_id: str = "" ) -> User: """ 创建用户 Args: user_id: 用户ID name: 用户名称 role: 角色 team_id: 团队ID Returns: User: 用户对象 """ permissions = self.role_permissions.get(role, []) user = User( id=user_id, name=name, role=role, team_id=team_id, permissions=permissions ) self.users[user_id] = user # 记录审计日志 self._log_audit( user_id=user_id, action='user:create', resource_type='user', resource_id=user_id, details={'name': name, 'role': role.value} ) return user ``` `scripts/permission_manager.py:175-198` ```python def assign_role(self, user_id: str, role: UserRole) -> bool: """ 分配角色 Args: user_id: 用户ID role: 新角色 Returns: bool: 是否成功 """ user = self.get_user(user_id) if not user: return False old_role = user.role user.role = role user.permissions = self.role_permissions.get(role, []) # 记录审计日志 self._log_audit( user_id=user_id, action='user:assign_role', resource_type='user', resource_id=user_id, details={'old_role': old_role.value, 'new_role': role.value} ) return True ``` Relevant workflow entry points accept no authenticated actor or authorization context: `scripts/workflow_engine.py:139-156` ```python def create_workflow(self, name: str, description: str = "") -> Workflow: workflow_id = str(uuid.uuid4())[:8] workflow = Wor ...[truncated 2996 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require an authenticated actor identity for every privileged operation: ```python def assign_role(self, actor_id: str, target_user_id: str, role: UserRole) -> bool: if not self.check_permission(actor_id, "team:manage"): raise PermissionError("Insufficient permission") ``` 2. Restrict administrator account creation to a controlled bootstrap process. Normal account-creation APIs must not accept an arbitrary administrator role. 3. Prohibit self-promotion and require stronger authorization or multi-party approval for granting administrator access. 4. Pass an authenticated principal into all workflow mutation and execution methods. 5. Enforce permissions inside `WorkflowEngine`, rather than relying on callers to perform optional checks: - `workflow:create` for creation - `workflow:edit` for node and connection changes - `workflow:delete` for deletion - `workflow:execute` for execution 6. Associate workflows with owners and teams, then enforce resource-level authorization in addition to role-level permission checks. 7. Before execution, require an approved workflow record where approval is mandated. Bind approval to an immutable workflow version or content hash so a workflow cannot be changed after approval. 8. Record both the actor and target account in audit events. Do not attribute administrative role changes to the target user. 9. Add negative security tests proving that guests and members cannot promote users, approve workflows, execute unauthorized workflows, or bypass pending/rejected approvals. ]]>