T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/telegram_client.py:78
- Finding
- Account-Wide Telegram Message Interception and External Processing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/telegram_client.py:78-90`, `scripts/main.py:36-76`, `scripts/agent.py:18-54` **Vulnerability Type**: Excessive message-monitoring scope and unauthorized external disclosure **Risk Level**: High ### Vulnerable Code ```python async def listen(self, callback): """Listen for incoming messages, call callback(chat_id, sender_id, text) for each.""" print("[TG] Starting message listener...") @self.client.on(events.NewMessage(incoming=True)) async def handler(event): chat_id = str(event.chat_id) sender_id = str(event.sender_id) text = event.raw_text or "" if text: await callback(chat_id, sender_id, text) await self.client.run_until_disconnected() ``` The captured content is passed to the agent without a chat allowlist: ```python async def on_message(chat_id: str, sender_id: str, text: str): # Skip own messages if sender_id == str(tg.my_id): return # Commands if text.strip().lower() == "/clear": agent.clear_history(chat_id) await tg.send(chat_id, "✅ Conversation history cleared.") return if text.strip().lower() == "/help": await tg.send(chat_id, ( "🤖 Customer Service Bot\n\n" "Ask me anything about our project.\n" "/clear - Clear conversation history\n" "/human - Request human support\n" "/help - Show this message" )) return if text.strip().lower() == "/human": await _handoff(tg, config, chat_id, sender_id, text="User requested human support") await tg.send(chat_id, "🙋 已通知人工客服，稍后会有专人联系您。") return # Agent response print(f"[MSG] {sender_id} in {chat_id}: {text[:80]}") try: await tg.set_typing(chat_id, True) result = agent.chat(chat_id, text) await tg.set_typing(chat_id, False) await tg.send(chat_id, result["reply"]) if resu ...[truncated 3846 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer the Telegram Bot API with a dedicated bot identity instead of authenticating a personal or general-purpose user account. 2. Implement a deny-by-default chat allowlist before passing content to the agent: - Allow only explicitly configured chat IDs. - Distinguish private chats, groups, channels, and service messages. - Reject unknown chats without sending their content externally. 3. Require explicit enrollment or consent before enabling AI processing for a conversation. 4. Add a dry-run or human-approval mode for responses sent from user accounts. 5. Minimize external disclosure: - Send only the current message when history is unnecessary. - Redact identifiers, credentials, wallet secrets, and other sensitive data. - Define retention and deletion limits for in-memory histories. 6. Clearly disclose that messages are processed by an external AI provider. 7. Add automated tests proving that unrelated chats cannot reach `Agent.chat()` or `TelegramClient.send()`. ]]>