T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- skill.py:835
- Finding
- Sensitive Write Operations Lack Enforced Authorization and Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `skill.py:835-856` **Related Locations**: `SKILL.md:46-48`; `skill.py:468-492`, `515-527`, `554-571`, `601-620`, `652-673`, `711-734`, `773-796`, `885-905`, `926-938` **Vulnerability Type**: Missing authorization and confirmation enforcement **Risk Level**: High ### Vulnerable Code ```python async def create_main_account( ctx: SkillContext, account: str, password: str, name: str, tenant_id: int, is_for_encryption: bool = False, ) -> str: body = { "account": account, "password": password, "name": name, "tenantId": tenant_id, "isForEncryptionPhones": is_for_encryption, } endpoint = "/AiSpeech/admin/addMainUser" try: result = _baize_post(endpoint, body) if str(result.get("code")) == "2000": return f"主账号 [{account}]（{name}）已成功创建，所属商户ID：{tenant_id}。" return f"创建主账号失败：{result.get('msg', '未知错误')}" except Exception as exc: return f"创建主账号时发生错误：{exc}" ``` The documented confirmation requirement is present only in the Skill instructions: ```markdown - 执行**启动/暂停/恢复任务**、**切换线路**、**调整并发**、**新建账号**等**写操作**前， 必须先向用户展示操作详情，等待确认后再执行。 ``` ### Technical Analysis The Skill documentation states that write operations require prior user confirmation and that creation of a main account is restricted to administrators. These requirements are not enforced by the implementation. The `ctx` parameter is accepted but never inspected to establish the caller's identity, role, tenant, or authorization. The function immediately constructs an administrative request using caller-supplied values and sends it through `_baize_post`. There is no confirmation token, operation-bound approval record, role check, tenant ownership check, or validation that the requested tenant and role identifiers belong to the authenticated caller. The same design is used by other mutating operations, including starting, stopping, a ...[truncated 2036 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce authorization in both the Skill and the Baize API. The server must remain the authoritative security boundary. 2. Derive the caller's identity, tenant, and roles from authenticated `SkillContext` data rather than accepting security-sensitive identity information solely as tool parameters. 3. Reject `create_main_account` unless the authenticated context proves that the caller has an explicit administrator permission. 4. For subaccount creation, validate that the requested `role_id` is assignable by the caller and cannot exceed the caller's own privileges. 5. Validate that task IDs, line IDs, and tenant IDs belong to a tenant the authenticated caller is permitted to manage. 6. Introduce a short-lived confirmation nonce for every mutation. Bind it cryptographically or server-side to the caller, operation type, target IDs, parameter values, and expiration time. 7. Require the action function to consume that nonce before sending the API request. A general conversational acknowledgment must not authorize a different operation or modified parameters. 8. Apply least privilege to `BAIZE_TOKEN`. Separate administrative account-management credentials from campaign-operation credentials. 9. Validate all inputs, including nonempty task arrays, allowed task and operator types, positive concurrency, permitted line-ratio ranges, and valid date formats. 10. Record an audit event containing the authenticated principal, approved operation, target resources, and remote response, while excluding passwords and tokens. ]]>