Fix Summary

The device.token.rotate endpoint allows an authenticated device to escalate its own scopes beyond what was originally approved during pairing, enabling privilege escalation from a limited device role to full admin access.

Issue Linkage

Fixes #20702

Security Snapshot

• CVSS v3.1: 8.1 (High)
• CVSS v4.0: 8.6 (High)

Implementation Details

Files Changed

• src/gateway/server-methods/devices.ts (+1/-1)
• src/infra/device-pairing.test.ts (+23/-2)
• src/infra/device-pairing.ts (+43/-6)

Technical Analysis

The vulnerability is reachable through a production code path where untrusted input can influence security-sensitive behavior without sufficient invariant enforcement. Current evidence indicates impact consistent with the summary: The device.token.rotate endpoint allows an authenticated device to escalate its own scopes beyond what was originally approved during pairing, enabling privilege escalation from a limited device role to full admin access.

Validation Evidence

• Command: pnpm build && pnpm check && pnpm test
• Status: passed

Risk and Compatibility

non-breaking; no known regression impact

AI-Assisted Disclosure

• AI-assisted: yes
• Model: GPT-5.3-Codex

Greptile Summary

Addresses device token scope escalation by introducing an approvedScopes field that preserves the originally approved scopes during device pairing and prevents unauthorized privilege escalation during token rotation.

Key changes:

• Added approvedScopes field to track scopes approved at pairing time in src/infra/device-pairing.ts:58
• Modified rotateDeviceToken to validate requested scopes against approvedScopes using scope implication logic in src/infra/device-pairing.ts:542-547
• Added expandScopeImplications and scopesAllowWithImplications helpers to handle hierarchical scope relationships (e.g., operator.admin implies operator.read) in src/infra/device-pairing.ts:170-190
• Removed automatic device.scopes mutation during rotation that previously allowed escalation in src/infra/device-pairing.ts:555-558 (removed lines)
• Protected approvedScopes from modification via updatePairedDeviceMetadata in src/infra/device-pairing.ts:374 and src/infra/device-pairing.ts:392
• Redacted approvedScopes from API responses to prevent information disclosure in src/gateway/server-methods/devices.ts:27
• Added comprehensive test coverage for both down-scoping (allowed) and escalation (blocked) scenarios

Confidence Score: 5/5

• This PR is safe to merge with high confidence - it properly fixes a critical security vulnerability without introducing new issues
• The fix correctly implements defense-in-depth by: (1) introducing an immutable approvedScopes baseline that cannot be modified after approval, (2) validating all rotation requests against this baseline with proper scope implication handling, (3) returning null instead of throwing on unauthorized escalation attempts to prevent state mutation, (4) protecting the security-sensitive field from external modification, and (5) comprehensive test coverage that validates both the vulnerability fix and legitimate down-scoping scenarios. The implementation follows security best practices by making the validation logic explicit, adding redaction to prevent information disclosure, and ensuring state remains unchanged when attacks are blocked.
• No files require special attention

_{Last reviewed commit: 93e73eb}