T05 · Unauthorized Access and Privilege Escalation
Note
- Location
- references/api-guide.md:73
- Finding
- Unnecessary inbound-message permission violates least privilege## Vulnerability Details **File Location**: `references/api-guide.md`, lines 73–77 **Vulnerability Type**: Excessive application permissions **Risk Level**: Low ### Vulnerable Code Snippet ```markdown ## 权限要求 发送消息需要飞书应用具备以下权限： - `im.message.send_as_bot` - 发送消息 - `im.message.receive_as_bot` - 接收消息 ``` ### Technical Analysis The skill's documented purpose and behavior are limited to constructing and sending Feishu Interactive Cards. The `im.message.send_as_bot` permission is consistent with that purpose, but the guide also identifies `im.message.receive_as_bot` as required. Inbound-message access is not necessary for the documented outbound-only functionality. Requesting it expands the application's authorization scope beyond the minimum privileges required for the task. Although the repository contains no code that directly abuses this permission, following the setup instructions would unnecessarily expose incoming message data to the associated Feishu application. ### Attack Path 1. An administrator follows the skill's API setup guide. 2. The administrator grants both the send and receive permissions to the Feishu application. 3. The application obtains access to incoming messages despite the skill only requiring outbound delivery. 4. If the application, its event-processing environment, or its credentials are later compromised, an attacker may use the excessive permission to access incoming conversation content available to the application. ### Impact Assessment The excessive permission broadens the application's data-access scope to inbound Feishu messages. The practical exposure depends on Feishu tenant configuration, event subscriptions, application installation scope, and platform enforcement. It does not itself grant code execution, persistence, or administrative privileges, but it increases the confidentiality impact of a compromised or misconfigured application.
- Remediation
- ## Remediation Suggestions - Remove `im.message.receive_as_bot` from the documented required permissions when the skill is used solely to send cards. - Document `im.message.send_as_bot` as the minimum permission for outbound delivery. - If inbound access is required by an undocumented feature or platform constraint, explain that dependency explicitly and separate it from the basic sending setup. - Restrict event subscriptions, application installation scope, and message processing to the minimum required chats and event types. - Periodically review granted Feishu permissions and revoke permissions not actively used. - Avoid logging incoming message content unless necessary, and apply appropriate retention and access controls where processing is required.