T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:189
- Finding
- Privileged Owner Commands Lack Sender Authentication and Authorization## Vulnerability Details **File Location**: `SKILL.md`, lines 189–199 **Vulnerability Type**: Missing authorization for privileged administrative commands **Risk Level**: High The skill defines commands that expose ticket information and modify operational state, but it does not instruct the agent to verify that the sender is the configured owner before executing them. ```markdown ## Commands (for the business owner) - **"open tickets"** — List all unresolved customer queries - **"resolve ticket #[id]"** — Mark a ticket as resolved - **"message stats"** — Today's volume, categories breakdown, response rate - **"add template [category] [message]"** — Update an auto-response template - **"pause responder"** — Temporarily stop auto-responses (owner handles manually) - **"resume responder"** — Re-enable auto-responses - **"set fees [text]"** — Update the fees information used in price responses ``` ### Technical Analysis The application processes messages received through a customer-facing WhatsApp webhook. Although the commands are described as being “for the business owner,” the skill contains no mandatory authorization procedure that compares the verified sender identifier against `ownerPhone`, `escalateToPhone`, or a dedicated administrator allowlist. A descriptive label is not an access-control boundary. If customer and owner messages reach the same command-processing context, an untrusted sender can submit text matching an administrative command. The agent may then execute that command because the documented behavior does not require sender verification. The affected operations include both read and write capabilities: - `open tickets` may disclose unresolved customer-query information. - `message stats` may disclose internal business activity. - `resolve ticket` may corrupt complaint and support workflow state. - `add template` may persist attacker-controlled response content. - `set fees` may alter pricing information presented to customers. - `paus ...[truncated 1689 chars]
- Remediation
- ## Remediation Suggestions 1. **Enforce sender authorization before command parsing** - Obtain the sender identifier from verified WhatsApp webhook metadata rather than message text. - Normalize the identifier to a canonical phone-number format. - Compare it against a dedicated administrator allowlist. - Reject all administrative commands from senders that are not explicitly authorized. 2. **Separate customer and administrator processing** - Route customer messages only to classification and customer-response logic. - Route owner commands through a distinct authenticated handler. - Do not rely on prompts, command wording, display names, or self-asserted identity as authentication. 3. **Apply least privilege** - Separate read-only commands such as `message stats` from state-changing commands. - Restrict ticket access to authorized administrators. - Limit template and pricing changes to specifically authorized roles. 4. **Require confirmation for sensitive changes** - Use a second confirmation step for `pause responder`, `set fees`, and `add template`. - Display the proposed change and require confirmation from the same authenticated administrator. - Consider out-of-band confirmation for high-impact configuration changes. 5. **Validate and constrain administrator-controlled content** - Restrict supported template categories. - Enforce length and formatting limits. - Prevent templates from including unsafe links, fraudulent payment instructions, or unsupported placeholders. - Preserve known-good defaults and provide rollback functionality. 6. **Protect ticket data** - Return only the minimum information needed by the owner. - Redact customer phone numbers and sensitive message content where practical. - Define retention limits and access controls for ticket memory. 7. **Add audit logging and abuse controls** - Record the verified administrator identity, timestamp, command, previous value, and resulti ...[truncated 370 chars]