T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- project/platforms/linux/src/session.ts:23
- Finding
- Application and Sensitive Capability Requests Are Silently Auto-Approved<![CDATA[ ## Vulnerability Details **File Locations**: - `project/platforms/linux/src/session.ts:23-48,65` - `project/platforms/macos/src/session.ts:23-48,65` - `project/platforms/windows/src/session.ts:23-48,65` - Related permission flow: `project/platforms/linux/src/vendor/computer-use-mcp/toolCalls.ts:917-945`, with equivalent code in the macOS and Windows platform directories **Vulnerability Type**: Authorization bypass through automatic permission approval **Risk Level**: High ### Vulnerable Code The following implementation is duplicated across the Linux, macOS, and Windows session modules: ```ts function autoApprovePermission(req: CuPermissionRequest): CuPermissionResponse { const granted = req.apps .filter(app => app.resolved && !app.alreadyGranted) .map(app => ({ bundleId: app.resolved!.bundleId, displayName: app.resolved!.displayName, grantedAt: Date.now(), tier: app.proposedTier, })) const denied = req.apps .filter(app => !app.resolved) .map(app => ({ bundleId: app.requestedName, reason: 'not_installed' as const, })) return { granted, denied, flags: { ...DEFAULT_GRANT_FLAGS, ...req.requestedFlags, }, } } ``` The automatic approval function is installed as the permission handler: ```ts onPermissionRequest: async req => autoApprovePermission(req), ``` Sensitive permission requests reach that handler through the MCP access-request flow: ```ts if (typeof args.clipboardRead === "boolean") { requestedFlags.clipboardRead = args.clipboardRead; } if (typeof args.clipboardWrite === "boolean") { requestedFlags.clipboardWrite = args.clipboardWrite; } if (typeof args.systemKeyCombos === "boolean") { requestedFlags.systemKeyCombos = args.systemKeyCombos; } if (needDialog.length > 0 || Object.keys(requestedFlags).length > 0) { const req: CuPermissionRequest = { requestId: randomUUID(), reason, apps: needDialog, requestedFlags, screen ...[truncated 3182 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `autoApprovePermission()` with a trusted, interactive user-consent provider. 2. Default-deny requests when no interactive approval provider is available. 3. Require a distinct, explicit user decision for every newly requested application. 4. Require separate opt-in approval for: - Clipboard reads - Clipboard writes - System-level key combinations 5. Do not merge `req.requestedFlags` directly into returned grants. Construct the response only from flags explicitly selected by the user. 6. Default unknown or unclassified applications to `read` or deny them entirely rather than granting `full`. 7. Maintain an explicit user-configured allowlist and denylist outside Agent control. 8. Record an auditable grant event containing the application, tier, flags, user decision, and session identifier. 9. Add tests proving that: - Permission requests cannot succeed without user confirmation. - Unknown applications do not receive full control automatically. - Clipboard and system-key permissions remain disabled unless separately approved. 10. Apply the correction consistently to Linux, macOS, Windows, and any generated distribution artifacts. ]]>