T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/linkedin.mjs:20- Finding
Write-capable LinkedIn operations are enabled by default
- Content
View full analysis
p.trim().toLowerCase()); // Commands that require write permission const WRITE_COMMANDS = [ 'send', 'start-chat', 'invite', 'cancel-invite', 'create-post', 'comment', 'react' ]; function checkPermission(cmd) { if (WRITE_COMMANDS.includes(cmd) && !hasWrite) { console.error(`Error: Command '${cmd}' requires write permission.`); console.error(`Current permissions: ${PERMISSIONS.join(', ')}`); console.error(`Set UNIPILE_PERMISSIONS=write or UNIPILE_PERMISSIONS=read,write to enable.`); process.exit(3); } if (READ_COMMANDS.includes(cmd) && !hasRead) { console.error(`Error: Command '${cmd}' requires read permission.`); console.error(`Current permissions: ${PERMISSIONS.join(', ')}`); console.error(`Set UNIPILE_PERMISSIONS=read to enable.`); process.exit(3); } } ``` ### Technical Analysis The authorization layer defaults `UNIPILE_PERMISSIONS` to `read,write` whenever the variable is absent. Consequently, write authorization is granted implicitly rather than through an explicit operator decision. The write-command list includes externally visible and account-modifying operations such as sending messages, starting chats, publishing posts, commenting, reacting, sending invitations, and canceling invitations. Although `checkPermission()` blocks write commands when the configured permissions exclude `write`, that protection does not apply under the default configuration because `hasWrite` evaluates to true. This violates secure-by-default and least-privilege principles. The documentation recommends read-only operation, but the executable behavior grants full access u ...[truncated 1334 chars]- Remediation
View remediation
permission.trim().toLowerCase()); ``` 2. Require explicit write authorization for every write-capable deployment. Do not infer write permission from an absent or malformed value. 3. Reject unrecognized and empty permission entries: ```javascript const VALID_PERMISSIONS = new Set(['read', 'write']); if ( PERMISSIONS.length === 0 || PERMISSIONS.some(permission => !VALID_PERMISSIONS.has(permission)) ) { throw new Error('UNIPILE_PERMISSIONS must contain only "read" and/or "write".'); } ``` 4. Add an explicit confirmation mechanism for externally visible operations such as sending messages, invitations, comments, and posts. For unattended automation, require a separate narrowly scoped confirmation flag. 5. Where supported by Unipile, enforce equivalent restrictions at the API-token or account level. The local environment variable should not be the only authorization boundary. 6. Update help text and documentation so the secure default and explicit write opt-in are consistent across the implementation and documentation. 7. Add tests confirming that all write commands fail when `UNIPILE_PERMISSIONS` is absent. ]]>