T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/smyx_child_drowsiness_fatigue_detection_analysis.py:58- Finding
Shared fallback identity allows cross-user access to sensitive analysis reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_child_drowsiness_fatigue_detection_analysis.py:58-65;skills/smyx_common/scripts/util.py:457-469, 576-603;skills/smyx_common/scripts/dao.py:474-497
Vulnerability Type: Improper user identity isolation and authorization context confusion
Risk Level: HighVulnerable Code
scripts/smyx_child_drowsiness_fatigue_detection_analysis.py:58-65:python # Initialize the internal user identity. OpenIdUtil.resolve_current_open_id( args.open_id, use_current=bool(args.open_id) ) if args.list: open_id = ConstantEnum.CURRENT__OPEN_ID result = show_analyze_list(open_id) print(result) exit(0)skills/smyx_common/scripts/util.py:457-469:python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """Resolve and initialize the current open-id.""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idskills/smyx_common/scripts/util.py:576-603:python if not (ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID): OpenIdUtil.resolve_current_open_id(use_current=False) current__user_name = ( ApiEnum.API_SECRET_KEY or ConstantEnum.CURRENT__USER_NAME or ConstantEnum.CURRENT__OPEN_ID ) found_user = None if (not ApiEnum.TOKEN or not ApiEnum.OPEN_TOKEN) and current__user_name: from .dao import UserDao, User user_dao = UserDao() found_user = use ...[truncated 4063 chars]- Remediation
View remediation
Remediation Suggestions
- Always prefer the trusted upstream identity when resolving the current user:
python OpenIdUtil.resolve_current_open_id( args.open_id, use_current=True )-
Remove workspace-global fallback identities from multi-user deployments. If anonymous operation is necessary, generate an identity scoped to the authenticated user or isolated session rather than reusing the first default database user.
-
Store tokens in per-user storage keyed by a trusted, authenticated upstream principal. Do not use a shared SQLite record or plaintext workspace identity file as the authorization context for unrelated users.
-
Pass the resolved principal explicitly through analysis and history methods instead of relying on mutable process-global fields such as
ConstantEnum.CURRENT__OPEN_IDandApiEnum.TOKEN. -
Enforce ownership on the server for all history, polling, and report-export operations. Report IDs must be checked against the authenticated account rather than accepted as sufficient authorization.
-
Ensure that hidden arguments such as
--open-idcannot override a trusted upstream identity unless the caller is explicitly authorized to impersonate that identity. -
Add isolation tests that create two upstream sender identities in the same workspace and verify that:
- Each identity receives separate cloud tokens.
- Each identity sees only its own analysis history.
- Report identifiers from one identity cannot be exported by the other.
- Omitting
--open-idpreserves the trusted environment-derived sender identity.