T09 · Insecure Skill Coding Practices
Error
- Location
- call-node.js:39
- Finding
- TLS Certificate Validation Disabled in the Node.js MCP Client## Vulnerability Details **File Location**: `call-node.js`, lines 39–48 **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: High ### Vulnerable Code ```javascript const options = { hostname: url.hostname, port: url.port, path: url.pathname, method: 'POST', headers: headers(t), timeout: timeout * 1000, rejectUnauthorized: false, }; ``` ### Technical Analysis The HTTPS request configuration explicitly sets `rejectUnauthorized` to `false`. This disables verification of the remote server's TLS certificate, including its trust chain and hostname identity. Although the connection remains encrypted, the client cannot establish that it is communicating with the legitimate iFinD MCP server. Any certificate presented by an intercepted or impersonated endpoint will be accepted. The client includes the configured authentication token in the `Authorization` header for initialization, notification, tool-listing, and tool-invocation requests. Consequently, a network-positioned attacker can obtain the token by presenting an untrusted certificate. The attacker can also inspect financial queries and return manipulated MCP responses. ### Attack Path 1. A user places a valid iFinD MCP authentication token in `mcp_config.json`. 2. The Node.js client constructs an HTTPS request containing the token in the `Authorization` header. 3. An attacker gains a network interception position, compromises a proxy, or redirects the target through DNS or routing manipulation. 4. The attacker presents a certificate that would normally fail trust or hostname validation. 5. The client accepts the certificate because `rejectUnauthorized` is disabled. 6. The attacker captures the authentication token and submitted financial-data queries. 7. The attacker may replay the token against the service within its granted permissions or return fabricated MCP data to the client. ### Impact Assessme ...[truncated 618 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `rejectUnauthorized: false` and retain the secure Node.js default: ```javascript const options = { hostname: url.hostname, port: url.port, path: url.pathname, method: 'POST', headers: headers(t), timeout: timeout * 1000, }; ``` 2. Do not introduce an environment-controlled option that silently disables certificate validation. 3. If the service relies on a private certificate authority, provide a narrowly scoped CA certificate through the `ca` option instead of disabling verification. 4. Validate failures using an invalid, expired, self-signed, and hostname-mismatched certificate to ensure that each connection is rejected. 5. Rotate any authentication token that may previously have been transmitted using this client over an untrusted network. 6. Apply least-privilege scopes and expiration to MCP authentication tokens where supported.