T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/senseaudio_platform_token.py:78
- Finding
- Implicit Chrome credential extraction and cookie-authenticated workspace operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/senseaudio_platform_token.py:78-130`; `scripts/senseaudio_clone_workspace.py:76-108,169-203,308-344`; `scripts/run_complete_rehearsal_service.py:176-224` **Vulnerability Type**: Least-privilege violation through browser credential discovery and implicit authenticated session reuse **Risk Level**: High ### Complete Code Snippets `scripts/senseaudio_platform_token.py:78-109`: ```python def resolve_from_chrome() -> Tuple[str, str]: script = """ (() => { const collect = storage => { const items = []; for (let i = 0; i < storage.length; i += 1) { const key = storage.key(i); items.push({ key, raw: storage.getItem(key) || '', storage: storage === window.localStorage ? 'localStorage' : 'sessionStorage' }); } return items; }; return JSON.stringify({ href: window.location.href, localStorage: collect(window.localStorage), sessionStorage: collect(window.sessionStorage), }); })() """ raw = apple_script(script) if not raw: return "", "" payload = json.loads(raw) for storage_name in ("localStorage", "sessionStorage"): for item in payload.get(storage_name, []): if not isinstance(item, dict): continue key = str(item.get("key", "")) raw_value = str(item.get("raw", "")) token = parse_zustand_payload(raw_value, key) if token: return token, f"{storage_name}:{key}" return "", "" ``` `scripts/senseaudio_platform_token.py:112-131`: ```python def resolve_platform_token( explicit_token: str = "", *, token_env: str = DEFAULT_PLATFORM_TOKEN_ENV, allow_chrome: bool = True, ) -> Tuple[str, str]: token = explicit_token.strip() if token: return token, "explicit" token = os.getenv(token_env, "").strip() if token: return token, f"env:{token_env}" if allow_chrome: try: token, key = ...[truncated 7041 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change `allow_chrome` to `False` by default and require an explicit `--browser-session` option. 2. Display a confirmation explaining that browser storage or cookies will be accessed before invoking AppleScript. 3. Do not enumerate every storage entry. If browser integration is unavoidable, retrieve only an exact, documented storage key. 4. Prefer short-lived, narrowly scoped API credentials supplied through a protected credential provider. 5. Separate read operations from mutating operations and require fresh confirmation before clone creation or slot reselection. 6. Remove automatic browser fallback: ```python if not token: raise SystemExit( "An explicit platform token is required. " "Use --browser-session only after confirming browser-session access." ) ``` 7. Apply domain and endpoint allowlists before executing browser `fetch` calls. 8. Document the exact account privileges required and reject credentials that provide broader permissions where scope inspection is supported. ]]>