T09 · Insecure Skill Coding Practices
Error
- Location
- app.py:13
- Finding
- OAuth-Authenticated Client Permits an Unrestricted MCP Endpoint## Vulnerability Details **File Location**: `app.py:13-19` **Vulnerability Type**: Unrestricted authenticated remote endpoint **Risk Level**: High ```python def __init__(self, url: str = "https://mcp.canva.com/mcp", auth=None) -> None: self.url = url self._oauth_auth = auth def _get_client(self) -> Client: oauth = self._oauth_auth or OAuth() return Client(self.url, auth=oauth) ``` ### Technical Analysis The public constructor accepts an arbitrary MCP endpoint and stores it without validating its scheme or hostname. `_get_client()` then creates an OAuth provider and attaches it to a client for that endpoint. Although the default endpoint is the legitimate Canva MCP service, calling code can replace it with another URL. If untrusted configuration, an environment integration, or another component can influence the constructor argument, the application may initiate an authenticated MCP session with an attacker-controlled service. There is no exact-host allowlist, HTTPS enforcement, or separation between production credentials and custom development endpoints. ### Attack Path 1. An attacker gains influence over the value passed to `CanvaApp(url=...)`, such as through an integrating application's configuration. 2. The attacker supplies an endpoint under their control. 3. The application invokes `_get_client()`. 4. The application constructs an OAuth-authenticated `Client` for the attacker-selected endpoint. 5. Authentication protocol data and subsequent tool arguments are sent to that endpoint. 6. The malicious endpoint can collect exposed information, return spoofed tool results, or attempt to induce unauthorized follow-up actions. Exploitation depends on an attacker being able to influence the constructor argument; the project does not itself expose a direct user-input route to this argument. ### Impact Assessment The issue can expose authentication-related material and sensitive tool argument ...[truncated 368 chars]
- Remediation
- ## Remediation Suggestions - Remove the configurable endpoint if custom MCP servers are not a required feature. - Enforce HTTPS and compare the parsed hostname against an exact allowlist, preferably only `mcp.canva.com`. - Reject URLs containing user information, unexpected ports, redirects to unapproved hosts, or nonstandard schemes. - If custom endpoints are required for development, place them behind an explicit unsafe-development option. - Never reuse production OAuth credentials with custom endpoints. Require a separate authentication provider and credential store. - Display the selected endpoint and require explicit user or administrator approval before authenticating to a non-default service. - Add tests covering HTTP URLs, look-alike domains, subdomain confusion, embedded credentials, unexpected ports, and redirect behavior.