T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ida_mcp_client.py:31
- Finding
- Unrestricted plaintext MCP endpoint permits analysis-data disclosure and response spoofing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ida_mcp_client.py:31-51` **Vulnerability Type**: Unvalidated remote endpoint configuration and plaintext transport **Risk Level**: Medium ### Vulnerable Code ```python URL = os.environ.get("IDA_MCP_URL", "http://127.0.0.1:13337/mcp") _session_id = None _req_id = 0 def _rpc(method, params=None): """发一条 JSON-RPC，返回 (result, error)。自动处理 session 头。""" global _session_id, _req_id _req_id += 1 payload = {"jsonrpc": "2.0", "id": _req_id, "method": method} if params is not None: payload["params"] = params headers = { "Content-Type": "application/json", "Accept": "application/json, text/event-stream", } if _session_id: headers["Mcp-Session-Id"] = _session_id req = urllib.request.Request( URL, data=json.dumps(payload).encode(), headers=headers, method="POST" ) ``` ### Technical Analysis The client obtains its MCP destination directly from the `IDA_MCP_URL` environment variable without validating the URL scheme, hostname, port, or trust level. The resulting endpoint is used for JSON-RPC requests without transport authentication. The default loopback endpoint limits exposure during normal operation. However, an inherited, compromised, or incorrectly configured environment can redirect the client to any attacker-controlled HTTP server. Because remote plaintext HTTP endpoints are accepted, a network-positioned attacker can also inspect or alter traffic when the override points outside the local host. MCP request bodies can contain proprietary reverse-engineering information, including binary addresses, decompilation targets, comments, type information, names, and batch analysis operations. Responses are trusted as MCP results and displayed to the user without server identity verification. The unrestricted override is also documented in `README.md:38` and `SKILL.md:40`, making remote endpoint use part of the supported configur ...[truncated 1886 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Restrict the default trust boundary** - Permit only loopback destinations by default. - Resolve the hostname and verify that every resolved address is loopback. - Reject embedded credentials, unexpected schemes, URL fragments, and malformed ports. 2. **Require explicit opt-in for remote access** - Add a flag such as `--allow-remote-mcp`. - Fail closed when `IDA_MCP_URL` resolves to a non-loopback address unless that flag or a narrowly scoped configuration setting is present. - Emit a clear warning identifying the destination before transmitting analysis data. 3. **Require encrypted transport remotely** - Reject `http://` for non-loopback endpoints. - Require `https://` with normal certificate and hostname validation. - Where practical, pin an internal certificate authority or server certificate for sensitive environments. 4. **Authenticate the MCP server** - Support an authentication token or mutual TLS. - Keep credentials outside source code and avoid exposing them in command-line arguments or logs. - Bind authentication to the approved server identity. 5. **Use an allowlist** - Allow administrators to configure approved MCP hostnames and ports. - Validate redirects or disable them so an approved endpoint cannot redirect requests to an untrusted destination. 6. **Document the data exposure** - State that tool arguments and results may contain confidential reverse-engineering data. - Clarify that remote plaintext endpoints are unsupported and unsafe. A minimal policy should reject any non-loopback endpoint unless remote operation is explicitly enabled, and should then require HTTPS plus server authentication. ]]>