T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/onebot-action.js:21
- Finding
- Unrestricted OneBot API Invocation Without an Action Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/onebot-action.js`, lines 21-25 and 72-76 **Vulnerability Type**: Missing authorization boundary and unrestricted privileged API dispatch **Risk Level**: High ### Vulnerable Code ```javascript function parseArgs(argv) { const action = argv[2]; if (!action) { console.error('Usage: node onebot-action.js <action> [key=value ...]'); console.error('Special: key=@/path/to/file reads file content as value'); process.exit(1); } ``` ```javascript ws.on('open', () => { const payload = { action, params, echo }; ws.send(JSON.stringify(payload)); }); ``` ### Technical Analysis The command-line `action` value is accepted verbatim and transmitted directly to the authenticated OneBot WebSocket endpoint. There is no allowlist restricting actions to the group-administration operations described in `SKILL.md`, no validation of the target group, and no confirmation or authorization mechanism for destructive operations. Consequently, this script is not limited to the documented functions. A caller able to invoke it can dispatch any action supported by the connected OneBot implementation, including undocumented or implementation-specific extension APIs. The exact available operations depend on the NapCat/OneBot server, but they may extend beyond group administration to messaging, account operations, request handling, or other bot capabilities. The skill documentation says that sensitive actions should be confirmed, but this requirement is not enforced by code. Documentation-only guidance does not provide a security boundary. ### Attack Path 1. An attacker influences an agent prompt, automation input, or other caller that can execute this skill. 2. The attacker supplies an arbitrary action name instead of one of the documented group-management actions. 3. The attacker supplies any parameters required by that action. 4. The script connects using the configured OneBot credential. 5. It forwards ...[truncated 996 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define an explicit allowlist of permitted actions, such as: - `set_group_name` - `_send_group_notice` - `set_group_ban` - `set_group_whole_ban` - `set_group_kick` - `set_group_admin` - `set_group_card` - `set_group_special_title` - `set_group_portrait` - `delete_msg` - `get_group_info` - `get_group_member_list` - `get_group_member_info` 2. Reject every action not present in the allowlist before opening the WebSocket. 3. Add action-specific schemas that reject unknown parameters and validate identifiers, booleans, durations, paths, and string lengths. 4. Enforce an authorized group-ID allowlist rather than permitting arbitrary targets. 5. Require an explicit confirmation token or separate privileged execution path for destructive actions such as kicking members, changing administrators, deleting messages, and imposing bans. 6. Separate read-only and mutating operations into different entry points and credentials where supported. 7. Record security audit logs containing the caller, action, target, and result, while excluding credentials and sensitive content. ]]>