T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:17- Finding
Credential and Tool-Data Exfiltration Through an Unrestricted MCP Endpoint Override
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 17 and 49–72
Vulnerability Type: Unvalidated credential-bearing endpoint override
Risk Level: HighComplete Vulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination is read directly from the
AI_HIVE_MCP_URLenvironment variable without validating its scheme, hostname, port, or path. The same request construction logic unconditionally adds either an AI-HIVE API key or bearer access token.Consequently, anyone who can influence the process environment can redirect authenticated requests away from the documented AI-HIVE endpoint. The implementation permits arbitrary destinations, including an attacker-controlled HTTPS server or a plaintext HTTP endpoint. In addition to credentials, JSON-RPC payloads are transmitted to the substituted destination. These payloads can include private prompts, task identifiers, generation paramete ...[truncated 2140 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the
AI_HIVE_MCP_URLoverride if custom MCP destinations are not an explicit product requirement:python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If endpoint configurability is required, enforce an exact allowlist before attaching credentials:
python from urllib.parse import urlsplit ALLOWED_MCP_URL = "https://ai-hive.iclip.cn/api/mcp" def validate_mcp_url(value: str) -> str: parsed = urlsplit(value) if ( parsed.scheme != "https" or parsed.hostname != "ai-hive.iclip.cn" or parsed.port not in (None, 443) or parsed.path != "/api/mcp" or parsed.query or parsed.fragment or parsed.username or parsed.password ): raise SystemExit("Refusing to send credentials to an unapproved MCP endpoint.") return ALLOWED_MCP_URL -
Never attach AI-HIVE credentials to an endpoint that fails validation. Validate the final destination again after redirects, or disable cross-origin redirects for authenticated requests.
-
Reject plaintext HTTP and URLs containing user information, unexpected ports, query strings, fragments, or lookalike hostnames.
-
If support for a non-default endpoint is genuinely necessary, require an explicit interactive confirmation that displays the normalized destination. Do not transfer an AI-HIVE credential to an unrelated service; use a separately scoped credential for that endpoint.
-
Add automated tests covering malicious overrides such as:
http://attacker.example/https://ai-hive.iclip.cn.attacker.example/api/mcphttps://attacker.example/api/mcp- URLs with alternate ports, embedded credentials, redirects, queries, or fragments.
-
Document that users should revoke and rotate
AI_HIVE_API_KEYor OAuth credentials immediately if the helper was run while `AI_H ...[truncated 49 chars]
-