T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:16- Finding
Arbitrary MCP Endpoint Override Can Disclose Authentication Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 16 and 44–69
Vulnerability Type: Credential disclosure through an unrestricted network destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination is taken directly from the
AI_HIVE_MCP_URLenvironment variable. The value is not checked for an HTTPS scheme, expected hostname, port, or path. Thepost()function then unconditionally attaches either the bearer access token or the AI-HIVE API key to requests sent to that destination.This violates the principle that credentials must be scoped to a trusted origin. Although sending credentials to the declared AI-HIVE MCP service is necessary for the Skill's functionality, allowing the same credentials to be sent to an arbitrary endpoint exceeds minimum privilege.
Depending on redirect behavior, origin-changing HTTP redirects may present an additiona ...[truncated 1471 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the
AI_HIVE_MCP_URLoverride if custom endpoints are not required. Use the fixed documented endpoint:python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If configurability is required, parse and validate the URL before creating an authenticated request. Require:
- Scheme exactly equal to
https - Hostname exactly equal to
ai-hive.iclip.cn - Expected HTTPS port
- Path exactly equal to
/api/mcp - No embedded username or password
- No untrusted fragments or ambiguous URL forms
- Scheme exactly equal to
-
Bind credential selection to the validated destination. Never add AI-HIVE authentication headers to requests targeting another origin.
-
Disable automatic redirects for authenticated requests or implement a redirect handler that rejects every cross-origin redirect. Revalidate the destination before forwarding credentials.
-
If custom MCP servers must be supported, require separate credentials explicitly scoped to each configured origin. Do not reuse
AI_HIVE_API_KEYorAI_HIVE_ACCESS_TOKEN. -
Add automated tests covering malicious overrides, including HTTP URLs, look-alike domains, alternate ports, user-info syntax, and redirects to another host.
-
Document that users who may have executed the script with an untrusted endpoint should immediately revoke and rotate the affected API key or OAuth token and review account activity.
-