T05 · Unauthorized Access and Privilege Escalation
- Location
project/src/session.ts:21- Finding
Permission Requests Are Silently Auto-Approved
- Content
View full analysis
Vulnerability Details
File Location:
project/src/session.ts:21-43andproject/src/session.ts:61
Vulnerability Type: Missing user authorization and automatic privilege granting
Risk Level: HighVulnerable Code:
ts function autoApprovePermission(req: CuPermissionRequest): CuPermissionResponse { const granted = req.apps .filter(app => app.resolved && !app.alreadyGranted) .map(app => ({ bundleId: app.resolved!.bundleId, displayName: app.resolved!.displayName, grantedAt: Date.now(), tier: app.proposedTier, })) const denied = req.apps .filter(app => !app.resolved) .map(app => ({ bundleId: app.requestedName, reason: 'not_installed' as const, })) return { granted, denied, flags: { ...DEFAULT_GRANT_FLAGS, ...req.requestedFlags, }, } }The automatic approval function is installed as the session permission handler:
ts onPermissionRequest: async req => autoApprovePermission(req),Technical Analysis
The MCP permission model is intended to require authorization before an agent can interact with applications or obtain sensitive capability flags. The standalone session replaces an interactive approval decision with
autoApprovePermission(), which grants every resolved application at the requested access tier.The function also copies all values from
req.requestedFlagsover the default grant flags. Consequently, an agent can request and receive capabilities such as clipboard read, clipboard write, or protected system-key combinations without an actual user confirmation step.These grants are subsequently stored in session state by
onAllowedAppsChanged, allowing later MCP calls to pass application and capability gates. This is particularly sensitive because the runtime can capture the desktop, enumerate processes and applications, read or modify th ...[truncated 2008 chars]- Remediation
View remediation
Remediation Suggestions
- Replace
autoApprovePermission()with an explicit user-confirmation mechanism that blocks until the user approves or rejects the request. - Present the exact application identifier, display name, requested access tier, and every requested capability flag.
- Default-deny clipboard read, clipboard write, and system-key capabilities.
- Maintain separate, revocable grants for each application and capability.
- Do not merge requested flags into session grants unless each flag has been explicitly authorized.
- If unattended operation is required, require an explicit opt-in configuration and a static allowlist created before server startup.
- Prevent the agent itself from modifying the unattended allowlist.
- Record authorization decisions in an audit log without storing sensitive clipboard or screenshot contents.
- Add tests proving that application access and sensitive flags are rejected when no user approval callback is available.
- Replace