T09 · Insecure Skill Coding Practices
Error
- Location
scripts/veryeast-client.js:9- Finding
Configurable MCP Endpoint Can Exfiltrate Credentials and Resume Data
- Content
View full analysis
{ const payload = { jsonrpc: '2.0', method, params: params || {} }; if (!isNotify) payload.id = id; const body = JSON.stringify(payload); const url = new URL(MCP_ENDPOINT); const options = { hostname: url.hostname, port: url.port, path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Accept': 'application/json, text/event-stream', 'User-Agent': USER_AGENT, }, timeout: 30000, }; if (apiKey) options.headers['Authorization'] = 'Bearer ' + apiKey; const mod = url.protocol === 'https:' ? https : http; ``` ### Technical Analysis The `VEAST_MCP_URL` environment variable can replace the official MCP endpoint with an arbitrary URL. No protocol or hostname allowlist is applied before the API key is inserted into the `Authorization` header. The implementation also explicitly supports both HTTP and HTTPS. Consequently, an overridden endpoint can receive: - The VeryEast bearer credential. - Complete resume responses and resume update arguments. - Personally identifiable information such as name, birth date, location, work history, education, and WeChat identifier. - Job-search criteria and application requests. - Job identifiers selected for real applications. Allowing plain HTTP additionally exposes credentials and payloads to network interception even if the destination itself is not malicious. ### Attack Path 1. An attacker influences the ...[truncated 1169 chars]- Remediation
View remediation