T09 · Insecure Skill Coding Practices
Error
- Location
- assets/mcp-app-template/server.ts:85
- Finding
- Unauthenticated MCP Endpoint Exposed on All Network Interfaces with Unrestricted CORS<![CDATA[ ## Vulnerability Details **File Location**: `assets/mcp-app-template/server.ts:85-102` **Additional Location**: `references/mcp-app-spec.md:161-178` **Vulnerability Type**: Missing authentication and overly permissive network access **Risk Level**: High ### Vulnerable Code ```ts const port = parseInt(process.env.PORT ?? "3001", 10); const app = createMcpExpressApp({ host: "0.0.0.0" }); app.use(cors()); app.all("/mcp", async (req, res) => { const server = createServer(); const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, }); res.on("close", () => { transport.close().catch(() => {}); server.close().catch(() => {}); }); try { await server.connect(transport); await transport.handleRequest(req, res, req.body); ``` ### Technical Analysis The MCP server binds to `0.0.0.0`, making it reachable through every available network interface. The default `cors()` middleware accepts requests from arbitrary browser origins. No authentication, authorization, or caller identity validation occurs before the request is passed to `transport.handleRequest()`. The same implementation is presented as the required server pattern in `references/mcp-app-spec.md`, meaning applications generated from this Skill are likely to preserve the vulnerable configuration. Although the included sample tool only produces generated sample data, this is a scaffolding project intended to be customized with tools that may access databases, private APIs, files, or other sensitive services. Those tools would inherit the unauthenticated endpoint unless the developer adds controls separately. ### Attack Path 1. A developer creates an application from this template and starts the server. 2. The service binds to all network interfaces on the configured port. 3. The developer exposes the service through a public tunnel, cloud deployment, container port mapping, or reachable local network. 4. An attacker discovers or obtains ...[truncated 1015 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind to the loopback interface by default: ```ts const app = createMcpExpressApp({ host: "127.0.0.1" }); ``` 2. Require authentication before passing requests to the MCP transport. Validate a bearer token, signed request, mTLS client identity, or another deployment-appropriate credential. 3. Enforce authorization separately for each tool. A valid identity should only be allowed to invoke tools and access resources assigned to that identity. 4. Replace unrestricted CORS with an explicit allowlist: ```ts app.use(cors({ origin: ["https://trusted-client.example"], methods: ["GET", "POST", "DELETE"], })); ``` 5. Add rate limiting, request-body size limits, timeouts, and audit logging to reduce denial-of-service and abuse risks. 6. Update `references/mcp-app-spec.md` so public exposure is never presented without authentication, authorization, and origin restrictions. 7. If a tunnel is used for testing, configure access control at the tunnel layer and use a short-lived, non-production environment containing no sensitive credentials or data. ]]>