T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/connect.sh:61
- Finding
- Unvalidated Server-Controlled Configuration Is Merged into the Trusted MCP Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/connect.sh:61-80` **Vulnerability Type**: Unvalidated remote MCP configuration injection **Risk Level**: High ### Vulnerable Code ```bash AGENT_TOKEN=$(echo "$BODY" | jq -r '.data.agentAccessToken') MCP_SNIPPET=$(echo "$BODY" | jq -c '.data.mcpConfigSnippet') if [ -z "$AGENT_TOKEN" ] || [ "$AGENT_TOKEN" = "null" ]; then echo '{"error":"parse_error","message":"Could not extract agentAccessToken from response"}' >&2 exit 1 fi if [ -z "$MCP_SNIPPET" ] || [ "$MCP_SNIPPET" = "null" ]; then echo '{"error":"parse_error","message":"Could not extract mcpConfigSnippet from response"}' >&2 exit 1 fi # ── Write/merge MCP config ─────────────────────────────────────────────────── MCP_CONFIG="${HOME}/.openclaw/mcp_config.json" if [ -f "$MCP_CONFIG" ]; then # Deep-merge: add/replace mcpServers.todo4, keep everything else TMP_CONFIG=$(mktemp) trap 'rm -f "$TMP_CONFIG"' EXIT jq --argjson snippet "$MCP_SNIPPET" '. * $snippet' "$MCP_CONFIG" > "$TMP_CONFIG" mv "$TMP_CONFIG" "$MCP_CONFIG" else mkdir -p "$(dirname "$MCP_CONFIG")" echo "$MCP_SNIPPET" | jq . > "$MCP_CONFIG" fi ``` ### Technical Analysis The script extracts `mcpConfigSnippet` from a remote API response and writes it into OpenClaw's trusted MCP configuration without validating its structure or contents. The merge expression `. * $snippet` does not enforce the comment's claim that only `mcpServers.todo4` will be added or replaced. It allows the remote response to introduce or replace arbitrary top-level configuration properties. The script also does not verify: - That the snippet contains only `mcpServers.todo4`. - That the MCP transport is an expected type. - That network destinations belong to Todo4. - That executable or stdio-based server definitions are absent. - That unrelated existing MCP server definitions remain unchanged. Although HTTPS protects the response in transit under ordinary conditions, the Todo4 API remains ...[truncated 1676 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not merge an arbitrary server-provided object into the complete MCP configuration. - Validate the response against a strict schema before writing it. - Require exactly one expected entry, such as `mcpServers.todo4`. - Construct the final Todo4 configuration locally from individually validated response fields. - Allowlist the expected transport and Todo4 HTTPS or WSS hostnames. - Reject stdio, executable command, shell argument, environment injection, and unexpected top-level fields. - Merge only the validated property: ```bash jq --argjson todo4 "$VALIDATED_TODO4_CONFIG" \ '.mcpServers.todo4 = $todo4' \ "$MCP_CONFIG" ``` - Preserve a backup and validate the complete resulting JSON before atomically replacing the existing configuration. - If practical, authenticate or sign configuration material independently so that a generic API compromise cannot silently redefine local tools. ]]>