T09 · Insecure Skill Coding Practices
Warning
- Location
- pipeline-mcp.yaml:5
- Finding
- Unauthenticated YAML Conversion Service Exposed on All Network Interfaces## Vulnerability Details **File Location**: `pipeline-mcp.yaml`, lines 5–11 **Vulnerability Type**: Unauthenticated network exposure and unbounded request processing **Risk Level**: Medium ### Vulnerable Code ```yaml http: enabled: true address: "0.0.0.0:${PORT:-8080}" input: http_server: path: /convert allowed_verbs: [POST] timeout: 30s ``` ### Technical Analysis The MCP pipeline binds its HTTP listener to `0.0.0.0`, making the `/convert` endpoint reachable through every network interface permitted by the host firewall. The reviewed configuration does not require authentication or authorization and does not define rate limiting. The endpoint passes attacker-controlled request content to `parse_yaml()`. Unlike the CLI pipeline, which specifies a 1 MiB `max_buffer`, the MCP pipeline does not explicitly impose a request-body size limit. Consequently, any client with network access can invoke YAML parsing repeatedly or submit unusually large or parser-intensive documents. This is an insecure configuration rather than evidence of deliberate malicious behavior. No command execution, credential access, data exfiltration, persistence, or privilege-escalation mechanism was found. ### Attack Path 1. An operator starts the MCP pipeline using `expanso-edge run pipeline-mcp.yaml`. 2. The service listens on all interfaces on `${PORT}`, or port `8080` by default. 3. An attacker who can reach that port sends unauthenticated `POST` requests to `/convert`. 4. The attacker submits large, complex, or numerous YAML documents. 5. The service parses each request, consuming CPU and memory until requests time out or host resources become constrained. 6. Repeated or concurrent requests may degrade availability for legitimate users or the host. ### Impact Assessment An attacker can obtain unauthorized use of the conversion endpoint and may degrade service availability through resource consumption. The affe ...[truncated 428 chars]
- Remediation
- ## Remediation Suggestions 1. Bind to `127.0.0.1` by default and require explicit operator configuration before exposing the service externally. 2. Require authentication and authorization for `/convert`, such as a validated bearer token or authenticated reverse proxy. 3. Configure a strict request-body size limit comparable to or smaller than the CLI pipeline's 1 MiB limit. 4. Add per-client and global rate limits, concurrency limits, and request quotas. 5. Place the service behind a hardened reverse proxy when remote access is required. 6. Restrict inbound traffic with host, container, or cloud firewall rules. 7. Apply CPU and memory limits to the service process and reject excessively complex YAML inputs. 8. Add security tests covering oversized payloads, high request concurrency, unauthenticated access, malformed YAML, and parser-intensive documents. 9. Document the endpoint's network exposure, authentication requirements, and safe deployment settings.