T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/mcp_client.py:35
- Finding
- Unvalidated MCP Endpoint Can Expose API Credentials and User Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mcp_client.py:35-43, 138-142` **Vulnerability Type**: Unrestricted credential-bearing endpoint configuration **Risk Level**: High **Category**: T09: Insecure Skill Coding Practices ### Vulnerable Code ```python def _post(self, payload: dict[str, Any], include_id: bool = True) -> dict[str, Any]: body = json.dumps(payload).encode("utf-8") headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "Accept": "application/json, text/event-stream", } if self.session_id: headers["mcp-session-id"] = self.session_id req = urllib.request.Request(self.endpoint, data=body, headers=headers, method="POST") ``` ```python def get_mcp_env() -> tuple[str, str]: api_key = os.environ.get("FILTRIX_MCP_API_KEY") or os.environ.get("MCP_API_KEY") if not api_key: raise RuntimeError("FILTRIX_MCP_API_KEY is required") endpoint = os.environ.get("FILTRIX_MCP_URL", DEFAULT_MCP_URL) return endpoint, api_key ``` ### Technical Analysis The client permits `FILTRIX_MCP_URL` to replace the default Filtrix endpoint without validating the URL scheme, hostname, port, or destination. The same client then attaches the Filtrix bearer token to every request sent to that endpoint. Generation requests can contain user prompts and Base64-encoded local images. Consequently, an attacker who can influence the environment variable can redirect the API key and user-supplied content to an attacker-controlled server. An `http://` endpoint is also accepted, allowing credentials and content to cross the network without transport encryption. Base64 conversion in `scripts/generate.py` is a documented serialization mechanism required by the image-to-video API and is not inherently covert. The vulnerability is that the resulting data and bearer credential can be sent to an unrestricted destination. ### Attack Path 1. An attacker, compromise ...[truncated 1326 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the endpoint with `urllib.parse.urlparse` before creating any request. 2. Require the `https` scheme for all production connections. 3. Allowlist `mcp.filtrix.ai` as the default and expected credential recipient. 4. Reject URLs containing user information, fragments, unexpected ports, malformed hostnames, or ambiguous IP representations. 5. If custom endpoints are required for development, require a separate explicit opt-in flag and separate credentials rather than automatically forwarding the production Filtrix key. 6. Display a clear warning or require confirmation before sending credentials or user content to a non-default endpoint. 7. Document that custom MCP endpoints receive prompts, images, request identifiers, and authentication headers. 8. Keep the API key scoped to only the necessary video-generation operations, if the service supports scoped credentials. 9. Add automated tests confirming rejection of plaintext HTTP, unapproved hosts, userinfo URLs, and malformed endpoint values. ]]>