T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:17- Finding
Unrestricted MCP Endpoint Override Can Expose API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 17–72
Vulnerability Type: Credential disclosure through an unrestricted network endpoint
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_idTechnical Analysis
The authenticated MCP destination is read directly from the
AI_HIVE_MCP_URLenvironment variable. The value is not validated against an allowed hostname, scheme, port, or origin beforeauth_headers()attaches either an AI-HIVE API key or OAuth bearer token.Consequently, the script can send credentials to any URL selected through the process environment, including an attacker-controlled HTTPS endpoint or a plaintext HTTP endp ...[truncated 1985 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
AI_HIVE_MCP_URLconfigurability if alternate endpoints are not required, and use the fixed documented URL:python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If endpoint overrides are operationally necessary, validate the URL before adding authentication headers:
- Require the
httpsscheme. - Allowlist the exact hostname
ai-hive.iclip.cn. - Require the expected
/api/mcppath. - Reject embedded usernames or passwords.
- Reject unexpected ports, fragments, and ambiguous host representations.
- Require the
-
Do not attach production credentials to non-production or untrusted endpoints. Require separate test credentials for explicitly approved development servers.
-
Disable or tightly control cross-origin redirects for authenticated requests. Verify that the final response origin remains the approved AI-HIVE origin and never resend sensitive headers to another origin.
-
If custom endpoints must be supported, require an explicit command-line opt-in and display the normalized destination before using credentials. Interactive confirmation should supplement, not replace, hostname and TLS validation.
-
Add automated tests proving that HTTP URLs, lookalike domains, embedded credentials, unexpected ports, and non-allowlisted hosts are rejected before
auth_headers()is called. -
Advise affected users to revoke and replace credentials if they have executed the client with an untrusted
AI_HIVE_MCP_URLvalue.
-