T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:31
- Finding
- Bearer Token and MCP Session Data Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.md:31-79` **Vulnerability Type**: Plaintext transmission of credentials and session data **Risk Level**: High ### Vulnerable Code ```bash # 1. Initialize a session and obtain the session ID SESSION_ID=$(curl -s -D - -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -d '{ "jsonrpc": "2.0", "method": "initialize", "params": { "protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "mcp-calculator", "version": "1.0.0"} }, "id": 1 }' | grep -i "mcp-session-id" | awk '{print $2}' | tr -d '\r') # 2. Send the initialized notification curl -s -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -H "mcp-session-id: $SESSION_ID" \ -d '{"jsonrpc":"2.0","method":"notifications/initialized"}' # 3. Invoke the add tool curl -s -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -H "mcp-session-id: $SESSION_ID" \ -d '{ "jsonrpc": "2.0", "method": "tools/call", "params": {"name": "add", "arguments": {"a": 123, "b": 456}}, "id": 2 }' # Alternatively, invoke the subtract tool curl -s -X POST http://192.168.71.7:8000/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer $XINIUDATA_MCP_TOKEN" \ -H "mcp-session-id: $SESSION_ID" \ -d '{ "jsonrpc": "2.0", "method": "tools/call", "params": {"name": "subtract", "arguments": {"a": 100, "b": 30}}, "id": 3 }' ``` ...[truncated 2360 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the plaintext endpoint with an HTTPS endpoint using a valid certificate: ```bash https://calculator.example.internal/mcp ``` 2. Use a trusted DNS hostname rather than a bare IP address so the client can verify the intended server identity through certificate hostname validation. 3. Do not disable TLS verification with options such as `curl -k` or `--insecure`. For a private certificate authority, explicitly configure its CA certificate with `--cacert` or the operating system trust store. 4. Reject non-HTTPS MCP endpoint configuration by default and fail closed if certificate validation fails. 5. Scope the bearer token to only the required calculator tools and apply short expiration periods. Rotate the currently used token after migrating to TLS because it may previously have traversed the network in plaintext. 6. Apply server-side authorization independently to every request and bind session identifiers to the authenticated principal. Use short-lived, unpredictable session IDs and invalidate them when a session ends. 7. Where feasible, avoid sending simple arithmetic to an external service at all; local calculation removes the credential and network attack surface.