T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Unrestricted MCP Endpoint Override Can Expose AI-HIVE Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 46–71
Vulnerability Type: Credential disclosure through an unrestricted network destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The client reads its MCP destination from the unvalidated
AI_HIVE_MCP_URLenvironment variable. It separately reads an API key or OAuth access token from the process environment and unconditionally adds that credential to every MCP POST request.No validation restricts the configured URL to HTTPS, the documented
ai-hive.iclip.cnhost, an expected port, or the intended/api/mcppath. Consequently, a manipulated execution environment can redirect authenticated requests to an arbitrary network endpoint.Credential transmission to the documented AI-HIVE service is necessary for authenticated MCP operations. Permitting an unrestricted destination override is not required ...[truncated 1650 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
AI_HIVE_MCP_URLconfigurability if custom MCP servers are not an explicit requirement, and use the fixed documented HTTPS endpoint. - If endpoint configuration is required, parse the URL before constructing any authenticated request and enforce:
- Scheme exactly equal to
https. - Hostname exactly equal to
ai-hive.iclip.cn. - No embedded username or password.
- Only the expected port.
- Path exactly equal to
/api/mcp.
- Scheme exactly equal to
- Prevent authenticated requests from following redirects to a different origin. Validate every redirect target or disable redirects and fail closed.
- Never attach AI-HIVE credentials to non-allowlisted origins. Separate endpoint selection from credential attachment so authentication headers are only added after origin validation.
- If development endpoints are genuinely needed, require an explicit command-line opt-in and separate development credentials rather than production credentials.
- Add automated tests covering HTTP URLs, lookalike domains, user-information URLs, unexpected ports, cross-origin redirects, and attacker-controlled hosts.
- Document that users should inspect and clear unexpected
AI_HIVE_MCP_URLvalues. If exposure is suspected, revoke the API key or OAuth authorization immediately.
- Remove