T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/collect-photos.sh:27- Finding
Photo Collection Extends Beyond the Declared Monthly Period
- Content
View full analysis
/scripts/collect-photos.sh "$MIXTILES_GROUP_JID" "$AFTER_DATE" "$OUTPUT_DIR" ``` ```bash MESSAGES_JSON=$(wacli messages search "*" \ --chat "$GROUP_JID" \ --type image \ --after "$AFTER_DATE" \ --limit 100 \ --json 2>/dev/null) ``` ### Technical Analysis The skill states that it collects photos from the previous month, but the search applies only a lower date boundary through `--after "$AFTER_DATE"`. It does not apply an exclusive upper boundary corresponding to the first day of the current month. Consequently, when the pipeline runs after the month changes, the search can return both previous-month photos and photos posted during the current month. This exceeds the task's documented collection scope and violates data-minimization and least-privilege principles for private family media. The `--limit 100` argument limits the number of returned messages but does not correct the date range. ### Attack Path 1. The monthly skill calculates the first day of the previous month. 2. The collection script searches for every image after that date. 3. Members post new images in the WhatsApp group during the current month. 4. The unbounded search includes those current-month images. 5. The script downloads the images to the local output directory. 6. The agent may inspect them during vision-based curation. 7. If selected, an out-of-period image may be uploaded to Cloudinary and included in the Mixtiles cart URL. No malicious group member is required; ordinary current-month activity is sufficient to trigger the scope violation. ### Impa ...[truncated 511 chars]- Remediation
View remediation