T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:22
- Finding
- Privileged Meta Ads Operations Delegated to a Third-Party MCP Gateway Without Documented Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-44`, `SKILL.md:77`, and corroborating configuration in `README.md:22-39` and `README.md:51-68` **Vulnerability Type**: Excessive third-party trust and insufficiently documented least-privilege controls **Risk Level**: Medium ### Vulnerable Code ```bash export HABILIS_API_KEY="hab_live_..." export META_ACCESS_TOKEN="EAA..." # Token do anunciante na ponta export META_AD_ACCOUNT_ID="act_..." ``` ```yaml mcp_servers: habilis: url: "https://xvix.com.br/api/mcp" headers: Authorization: "Bearer ${HABILIS_API_KEY}" ``` ```text - `mcp__meta_ads__upload_image`: Faz upload de imagens e criativos renderizados para a biblioteca da conta. - `mcp__meta_ads__create_ad_creative`: Registra criativos dinâmicos ou de imagem única com headline, copy e CTA. - `mcp__meta_ads__update_ad`: Atualiza o criativo de anúncios existentes ou substitui variações pausadas. ``` ```text 4. **Publicação via MCP:** Invoca `mcp__meta_ads__create_ad_creative` através do gateway Habilis (`https://xvix.com.br/api/mcp`) para subir o criativo aprovado. ``` ### Technical Analysis The Skill instructs users to configure sensitive Meta advertising credentials and connect the agent to the third-party Habilis MCP endpoint. The MCP tool surface includes state-changing operations that can upload assets, create advertising creatives, and update existing advertisements. These operations are consistent with the Skill's advertised purpose, but the package does not document or enforce: - Short-lived or narrowly scoped Meta access tokens. - Restriction of operations to a specific advertising account. - A mandatory human-approval control before each create or update operation. - Restrictions preventing unexpected MCP tools or parameters from being used. - Gateway credential-storage, forwarding, logging, and retention behavior. - Request signing, server pinning, or other controls beyond HTTPS and bearer authentication. - Advertisi ...[truncated 2213 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use short-lived Meta access tokens with only the permissions required to upload and manage creatives. 2. Restrict credentials to explicitly approved advertising accounts and avoid organization-wide or administrator-level tokens. 3. Require an explicit human confirmation immediately before every upload, create, or update operation, displaying the target account, advertisement, creative content, destination URL, and parameters. 4. Enforce an allowlist of permitted MCP tools and reject undeclared or unexpected tool calls returned by the gateway. 5. Validate all MCP arguments locally, including account identifiers, advertisement identifiers, URLs, CTA values, and uploaded asset types. 6. Prefer direct use of Meta's official API where practical, reducing the number of entities that receive or exercise privileged access. 7. Document whether Meta tokens are transmitted to, processed by, logged by, or retained by the Habilis gateway. Support any “Zero Storage” claim with a verifiable policy and technical controls. 8. Rotate Habilis and Meta credentials regularly, revoke them immediately after suspected exposure, and prevent credentials from appearing in logs or agent output. 9. Enable Meta account alerts, audit logging, role separation, spending limits, and campaign-level safeguards. 10. Document the gateway's security and incident-response model, including tenant isolation, request authentication, retention periods, and credential compromise procedures. ]]>