T07 · Tool Hijacking and Spoofing
- Location
scripts/bootstrap-receipt.sh:11- Finding
Existing MCP Connection Is Trusted Without Canonical Endpoint Validation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/bootstrap-receipt.sh, lines 11–18
Vulnerability Type: Improper validation of an existing trusted tool connection
Risk Level: MediumVulnerable Code
bash if ! openclaw mcp show receipt --json >/dev/null 2>&1; then openclaw mcp set receipt \ '{"url":"https://receiptprotocol.com/mcp","transport":"streamable-http","auth":"oauth","supportsParallelToolCalls":false}' fi openclaw mcp tools receipt --include 'receipt_*' login_output="" if ! login_output="$(openclaw mcp login receipt 2>&1)"; then fail "OpenClaw could not start the Receipt OAuth authorization attempt." fiTechnical Analysis
The bootstrap script checks only whether an MCP connection named
receiptexists. When it exists, the script does not parse the output ofopenclaw mcp show receipt --jsonor verify that the connection uses:- The canonical
https://receiptprotocol.com/mcpendpoint - The expected
streamable-httptransport - OAuth authentication
- Disabled parallel tool calls
The script then applies the trusted
receipt_*tool filter and starts OAuth login against whichever connection currently owns thereceiptname.This behavior conflicts with the documented requirement that the connection use the canonical Receipt endpoint. A connection name is a local identifier, not proof of server identity. Treating the name as sufficient validation creates an opportunity for a stale, incorrectly configured, or maliciously pre-seeded MCP connection to be presented as the trusted Receipt commerce service.
Attack Path
- An attacker or compromised local process with access to the user's OpenClaw configuration registers a noncanonical MCP server under the name
receipt. - The user invokes the Receipt bootstrap script.
openclaw mcp show receipt --jsonsucceeds because the named connection exists.- The script skips the canonical
openclaw mcp set receiptoperation without validating the existing endpoint ...[truncated 1308 chars]
- The canonical
- Remediation
View remediation
Remediation Suggestions
- Parse the existing connection's JSON configuration rather than using the command's exit status as proof of correctness.
- Require exact matches for the canonical endpoint, transport, authentication mode, and parallel-call policy before continuing.
- Fail closed when an existing connection differs from the expected configuration. Display the mismatched fields and require explicit owner approval before replacing or removing it.
- Revalidate the connection after configuration and again after OAuth completion.
- Before any Receipt tool call or purchase, verify that the active connection still maps to the canonical HTTPS origin.
- Validate the exposed tools against an exact allowlist of the eight documented
receipt_*tools, not only a wildcard include filter. - Ensure authorization URLs and approval URLs are validated against the expected HTTPS origin before presenting them to the user.
A hardened flow should resemble:
bash connection_json="$(openclaw mcp show receipt --json 2>/dev/null || true)" if [[ -z "$connection_json" ]]; then openclaw mcp set receipt \ '{"url":"https://receiptprotocol.com/mcp","transport":"streamable-http","auth":"oauth","supportsParallelToolCalls":false}' else # Parse with a trusted JSON parser and fail unless every security-relevant # field exactly matches the canonical configuration. validate_receipt_connection "$connection_json" || fail "The existing receipt MCP connection is noncanonical. Stop and obtain owner approval before replacing it." fiThe actual implementation should use a reliable JSON parser and avoid substring or regular-expression checks over serialized JSON.