T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- hooks/humanos-guard/handler.ts:113
- Finding
- Mandate constraints are retrieved but never enforced<![CDATA[ ## Vulnerability Details **File Location**: `hooks/humanos-guard/handler.ts:91-92, 113-126, 173-193` **Vulnerability Type**: Authorization constraint bypass **Risk Level**: High ### Vulnerable Code ```typescript const encodedScope = encodeURIComponent(scope); const encodedTool = encodeURIComponent(toolName); const url = `${apiUrl}/v1/via/mandates?scope=${encodedScope}&toolName=${encodedTool}`; ``` ```typescript return { valid: true, mandate: { id: mandate.id, scope: mandate.scope, validUntil: validUntil.toISOString(), constraints: mandate.constraints, }, }; ``` ```typescript const scope = _extractScope(toolName, args); const result = await _checkMandateViaApi(toolName, scope); if (!result.valid) { const reason = result.reason || "No valid mandate"; event.messages.push( `Action blocked by VIA Mandate Guard. ${reason}. ` + `Use the humanos skill to create an approval request before proceeding. ` + `Example: "I need approval from manager@company.com to ${scope}"` ); console.log(`[humanos-guard] BLOCKED: ${toolName} — ${reason}`); if (event.context && typeof event.context === "object") { (event.context as Record<string, unknown>).blocked = true; (event.context as Record<string, unknown>).blockReason = reason; } } else { console.log( `[humanos-guard] ALLOWED: ${toolName} — mandate ${result.mandate?.id} valid until ${result.mandate?.validUntil}` ); } ``` ### Technical Analysis The hook queries mandates using only a broad scope and tool name. It does not send a canonical representation of the proposed action, including critical attributes such as the payment amount, recipient, document identifier, destination account, or affected resource. Although the API response can contain `mandate.constraints`, the hook merely copies those constraints into the result object. It never compares them with the actual tool arguments before allowing execution. Consequently, any non-expired and non-rev ...[truncated 1442 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define a canonical action schema containing the tool name, operation, amount, currency, recipient, resource identifiers, and other security-relevant arguments. 2. Bind the approval cryptographically to a digest of that canonical action. 3. Submit the action digest or complete canonical action when querying the mandate service. 4. Implement strict local validation of every returned constraint before allowing execution. 5. Reject unknown, malformed, missing, or unsupported constraints instead of treating them as optional. 6. Validate that the mandate scope exactly matches the requested operation rather than relying on a broad inferred scope. 7. Add tests covering amount increases, recipient changes, resource substitutions, expired constraints, and malformed constraint objects. ]]>