T09 · Insecure Skill Coding Practices
Warning
- Location
- pipeline-mcp.yaml:5
- Finding
- Unauthenticated HTTP Service Exposed on All Network Interfaces## Vulnerability Details **File Location**: `pipeline-mcp.yaml:5-13` **Vulnerability Type**: Unauthenticated network exposure and missing request-size controls **Risk Level**: Medium ```yaml http: enabled: true address: "0.0.0.0:${PORT:-8080}" input: http_server: path: /flatten allowed_verbs: [POST] timeout: 30s ``` ### Technical Analysis The MCP pipeline binds its HTTP listener to `0.0.0.0`, making the service available through every network interface permitted by the deployment environment. No authentication, authorization, or network access restriction is configured for the `/flatten` endpoint. The HTTP input also lacks an explicit request-body size limit. The CLI pipeline defines a one-megabyte buffer limit, but no equivalent control is present here. An unauthenticated, network-reachable client can therefore submit requests for JSON parsing and response generation. The pipeline includes the parsed input in `root.original`, so attacker-supplied content is reflected in the synchronous response. ### Attack Path 1. An operator starts `pipeline-mcp.yaml` on a host or container whose configured port is reachable by an untrusted party. 2. The service listens on every interface at `${PORT:-8080}`. 3. The attacker sends unauthenticated `POST` requests to `/flatten`. 4. The pipeline parses the supplied JSON, computes its keys, and returns the supplied object in the response. 5. The attacker repeats requests or supplies resource-intensive payloads to consume parsing, memory, connection, and response-bandwidth capacity. This path depends on the deployment port being exposed to the attacker; the configuration alone does not prove public Internet reachability. ### Impact Assessment An attacker can invoke the pipeline without credentials and process arbitrary submitted JSON within the service's runtime privileges. The finding does not provide operating-system command execution or privilege escala ...[truncated 324 chars]
- Remediation
- ## Remediation Suggestions - Bind to `127.0.0.1` by default when remote access is not explicitly required. - Require authenticated requests and enforce authorization appropriate to the deployment. - Place remotely accessible deployments behind a reverse proxy or gateway that provides TLS, authentication, request-body limits, rate limiting, and connection limits. - Configure an explicit, conservative maximum HTTP request-body size comparable to the CLI pipeline's one-megabyte limit. - Add concurrency limits, request-rate limits, and bounded parsing time and memory. - Restrict network ingress through firewall rules, security groups, or container network policies. - Avoid returning `root.original` unless reflecting the complete submitted object is required. - Document that direct public exposure of the listener is unsafe without compensating access controls. - Add tests confirming rejection of unauthenticated, oversized, and excessive requests.