T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/smyx_aquarium_plant_health_monitor_analysis.py:47- Finding
Unverified caller-controlled identity enables service account impersonation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_aquarium_plant_health_monitor_analysis.py:47, 55-58;skills/smyx_common/scripts/util.py:454-470, 551-565, 578-612
Vulnerability Type: Improper authentication and user-controlled identity binding
Risk Level: HighVulnerable Code
scripts/smyx_aquarium_plant_health_monitor_analysis.py:47, 55-58:python parser.add_argument("--open-id", required=False, help=argparse.SUPPRESS) args = parser.parse_args() try: # Initialize internal user identity. OpenIdUtil.resolve_current_open_id( args.open_id, use_current=bool(args.open_id) )skills/smyx_common/scripts/util.py:454-470:python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """Resolve and initialize the current open-id.""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idskills/smyx_common/scripts/util.py:551-565:python def _get_or_create_user(username): _url = ApiEnum.BASE_URL_HEALTH + "/sys/phoneLogin" open_id = username _data = { "silent": 1, "register": 1, "openId": open_id, "mobile": username, "source": ConstantEnum.DEFAULT__SKILL_HUB_NAME } try: _response = requests.post(_url, json=_data) if _response.status_code == 200: _response_json = _response.json() if _response_json and _response_json.get("success"): ...[truncated 4714 chars]- Remediation
View remediation
Remediation Suggestions
- Remove direct caller control over
--open-id. Internal identity values should be supplied only through a trusted integration boundary, not an ordinary CLI argument. - If upstream identity propagation is required, accept a signed identity assertion and validate its signature, issuer, audience, subject, expiry, and nonce before assigning identity state.
- Do not use an
openIdor mobile value as sufficient evidence for silent login. The server should require established account credentials, a trusted service credential, or a verifiable one-time authentication flow. - Disable automatic registration during authenticated history access. Registration and login should be separate operations with explicit authorization requirements.
- Enforce report ownership and tenant isolation on every server-side analysis, result, page, and export endpoint. Never rely solely on
pnaUserNameor another client-supplied identity field. - Require the documented API-key or equivalent trusted client authentication before issuing user-scoped tokens.
- Bind locally cached tokens to a verified subject, issuer, audience, and tenant. Reject a cached token if those properties do not match the current authenticated context.
- Avoid storing reusable access tokens in a shared workspace database unless necessary. Use operating-system credential storage, restrictive file permissions, encryption at rest, and short token lifetimes.
- Add negative tests confirming that one user cannot request tokens, history, report exports, or analysis operations by supplying another user's identifier.
- Remove direct caller control over