T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/feishu_task_integration.py:23
- Finding
- Hardcoded and Undisclosed User Automatically Receives Task Access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu_task_integration.py:23, 111-112, 141-169, 182`; related fallback at `scripts/todo_handler.py:132-146` **Vulnerability Type**: Unauthorized task assignment and disclosure to an undeclared identity **Risk Level**: High ### Code Evidence ```python self.current_user_id = "ou_19c0ea5e1a6d3e318b52f4978684bd03" ``` ```python def create_task(self, title, description="", due_date=None, followers=None, assignees=None, add_yangbin=True, add_current_user=True): ``` ```python final_followers = followers or [] if add_current_user and self.current_user_id: current_user_follower = {"id": self.current_user_id} if current_user_follower not in final_followers: final_followers.append(current_user_follower) if add_yangbin and self.yangbin_user_id: yangbin_follower = {"id": self.yangbin_user_id} if yangbin_follower not in final_followers: final_followers.append(yangbin_follower) final_assignees = assignees or [] if add_current_user and self.current_user_id: current_user_assignee = {"id": self.current_user_id} if current_user_assignee not in final_assignees: final_assignees.append(current_user_assignee) if add_yangbin and self.yangbin_user_id: yangbin_assignee = {"id": self.yangbin_user_id} if yangbin_assignee not in final_assignees: final_assignees.append(yangbin_assignee) ``` ```python response = requests.post(url, headers=headers, json=data) ``` The related handler also falls back to the hardcoded identity: ```python if hasattr(manager, 'assignee_user_id') and manager.assignee_user_id: members.append({ "id": manager.assignee_user_id, "type": "user", "role": "assignee" }) else: members.append({ "id": manager.current_user_id, "type": "user", "role": "assignee" }) data["members"] = members response = requests.post(url, headers=headers, json=data) ``` ### Technical Analysis T ...[truncated 2003 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded Open ID from the source code. 2. Remove personally named recipient behavior and replace it with neutral, explicitly configured recipient lists. 3. Require `current_user_id` or `assignee_user_id` to be supplied through validated configuration or an authenticated user lookup. 4. Fail safely when no recipient is configured instead of silently using a fallback identity. 5. Set optional recipient flags to disabled by default. 6. Display the final follower and assignee identities and obtain confirmation before sending task content. 7. Validate that every recipient belongs to the expected tenant and is authorized for the specific task. 8. Add tests verifying that no undeclared recipient is inserted into task requests. 9. Remove any previously created unauthorized task memberships and review whether the hardcoded account received sensitive tasks. ]]>