T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- definitions/generic_task.json:55
- Finding
- Unrestricted Generic ERP Operations and Arbitrary Document Method Invocation<![CDATA[ ## Vulnerability Details **File Location**: `definitions/generic_task.json`, lines 8-19, 55-60, 105-143, 172-211, and 234-239 **Vulnerability Type**: Unrestricted privileged operations and user-controlled method invocation **Risk Level**: High ### Vulnerable Code Broad natural-language phrases can activate the generic workflow: ```json "triggers": [ "do something", "handle this", "custom task", "general task", "process", "execute", "run report", "check status", "update record", "bulk operation", "anything else", "other task" ] ``` The workflow exposes consequential actions against a user-selected DocType: ```json "action": { "type": "string", "enum": [ "create", "read", "update", "delete", "list", "search", "submit", "cancel", "custom" ], "description": "Action to perform" } ``` Update and deletion operations accept the target DocType, record name, and replacement data directly from the execution context: ```json "if_action_is_update": { "steps": [ { "step": "get_document", "tool": "get_document", "arguments": { "doctype": "${target_doctype}", "name": "${target_name}" } }, { "step": "update_document", "tool": "update_document", "arguments": { "doctype": "${target_doctype}", "name": "${target_name}", "data": "${data}" } } ] }, "if_action_is_delete": { "steps": [ { "step": "get_document", "tool": "get_document", "arguments": { "doctype": "${target_doctype}", "name": "${target_name}" } }, { "step": "delete_document", "tool": "delete_document", "arguments": { "doctype": "${target_doctype}", "name": "${target_name}" } } ] } ``` Submit, cancel, and arbitrary document-method operations are similarly exposed: ```json "if_action_is_submit": { "steps": [ { "step": "submi ...[truncated 3688 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `custom` and `run_doc_method` from the generic workflow unless there is a documented business requirement. 2. If custom methods are necessary, enforce a server-side allowlist of permitted DocTypes, methods, and argument schemas. Deny all unrecognized combinations. 3. Define separate narrowly scoped workflows for read, update, submit, cancel, and administrative operations rather than routing them through a universal dispatcher. 4. Require explicit, contextual confirmation before update, delete, submit, cancel, payment, stock, and custom-method operations. 5. Enforce authorization in the MCP tool and ERPNext server layers before every operation. Do not treat JSON guardrail flags as security controls unless the loader demonstrably enforces them. 6. Run the Agent under a dedicated least-privilege ERPNext account rather than an Administrator-equivalent identity. 7. Restrict generic triggers to explicit phrases so ordinary words such as “process” or “execute” cannot activate the workflow accidentally. 8. Log the authenticated user, target DocType, target record, method, sanitized arguments, confirmation event, and operation result in an immutable audit trail. 9. Add automated tests proving that unauthorized DocTypes and methods are rejected even when the Agent supplies syntactically valid requests. ]]>