T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp_client.py:35- Finding
Unvalidated MCP Endpoint Can Expose API Credentials and User Content
- Content
View full analysis
dict[str, Any]: body = json.dumps(payload).encode("utf-8") headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "Accept": "application/json, text/event-stream", } if self.session_id: headers["mcp-session-id"] = self.session_id req = urllib.request.Request(self.endpoint, data=body, headers=headers, method="POST") ``` ```python def get_mcp_env() -> tuple[str, str]: api_key = os.environ.get("FILTRIX_MCP_API_KEY") or os.environ.get("MCP_API_KEY") if not api_key: raise RuntimeError("FILTRIX_MCP_API_KEY is required") endpoint = os.environ.get("FILTRIX_MCP_URL", DEFAULT_MCP_URL) return endpoint, api_key ``` ### Technical Analysis The client permits `FILTRIX_MCP_URL` to replace the default Filtrix endpoint without validating the URL scheme, hostname, port, or destination. The same client then attaches the Filtrix bearer token to every request sent to that endpoint. Generation requests can contain user prompts and Base64-encoded local images. Consequently, an attacker who can influence the environment variable can redirect the API key and user-supplied content to an attacker-controlled server. An `http://` endpoint is also accepted, allowing credentials and content to cross the network without transport encryption. Base64 conversion in `scripts/generate.py` is a documented serialization mechanism required by the image-to-video API and is not inherently covert. The vulnerability is that the resulting data and bearer credential can be sent to an unrestricted destination. ### Attack Path 1. An attacker, compromise ...[truncated 1326 chars]- Remediation
View remediation