T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/call_api.py:47- Finding
User-Supplied Text Is Transmitted to an External Service Without Clear Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tools.py:20-25andscripts/call_api.py:47-77
Vulnerability Type: Excessive external data disclosure and violation of least privilege
Risk Level: HighVulnerable Code
python arguments = { "text": text, "char": char, "n": n } return call_api("1777419060716547", "find_nth_char", arguments)python def call_tool( self, mcp_id: str, tool_name: str, params: dict[str, Any], ) -> HttpResult: """调用小笨羊MCP工具""" url = f"{settings.base_url}/api" mcp_id = mcp_id or settings.mcp_id api_key = get_api_key() if not api_key: raise UpstreamError("API密钥未设置，请先调用 set_api_key()") headers = { "XBY-APIKEY": api_key, "func": tool_name, "mcpid": mcp_id, "Content-Type": "application/json", } # data = {k: str(v) if v is not None else "" for k, v in params.items()} t0 = time.time() try: resp = self._session.post( url=url, headers=headers, data=json.dumps(params), timeout=settings.timeout_seconds, )Technical Analysis
The tool wrappers place complete user-supplied strings into an argument dictionary and pass that dictionary to
call_api. The API client serializes the parameters as JSON and sends them tohttps://mcp.xiaobenyang.com/api, together with the user's API key.This behavior applies throughout
scripts/tools.py, including character indexing, substring extraction, regular-expression matching, replacement, and counting operations. These deterministic string operations could be implemented locally and do not inherently require external network access. Sending their complete input to a third party therefore exceeds the minimum access needed to perform the advertised task.Although the documentation states that an API is called, it does not clearly explain that the entire input text will leave the local environment. Us ...[truncated 1351 chars]
- Remediation
View remediation
Remediation Suggestions
- Implement the deterministic string-processing operations locally so user content does not leave the environment.
- If remote processing is essential, obtain explicit informed consent before transmitting content.
- Clearly document:
- The destination host.
- The exact fields transmitted.
- Whether request bodies are logged.
- Data retention and deletion policies.
- Any subprocessors or additional recipients.
- Provide a local-only mode and make it the default for sensitive inputs.
- Detect and redact likely credentials, tokens, and other secrets before network transmission.
- Minimize request contents so only strictly necessary data is sent.
- Add configurable outbound-host allowlisting and prevent runtime redirection to untrusted destinations.
- Add tests confirming that local operations do not unexpectedly generate network traffic.