T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Credential Disclosure Through an Unrestricted MCP Endpoint Override
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 47–72
Vulnerability Type: Credential forwarding to an environment-controlled network destination
Risk Level: MediumVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The script obtains an API key or OAuth access token from the process environment and adds it to every credentialed MCP request. This transmission is necessary for the declared remote MCP functionality when the default AI-HIVE endpoint is used.
However, the credential-bearing destination is also taken from the
AI_HIVE_MCP_URLenvironment variable. The code performs no scheme validation, origin validation, hostname allowlisting, or explicit trust confirmation before attaching the credential. Consequently, a process that can influence the script's environment can redirect the authorization header or API-key header to an unrelated server.This exceeds the minimum privilege needed for the declared functionality. Supporting a configurable MC ...[truncated 1802 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin the credential-bearing endpoint. Use the fixed AI-HIVE URL for authenticated requests rather than accepting an unrestricted environment override.
python MCP_URL = "https://ai-hive.iclip.cn/api/mcp"-
If custom endpoints are required, validate them before loading credentials.
- Require HTTPS.
- Reject embedded user information.
- Require the expected hostname and port, or use a narrow explicit allowlist.
- Normalize and compare the parsed origin before constructing authentication headers.
- Reject redirects to a different origin.
-
Separate endpoint selection from credential selection. Associate credentials with a specific trusted origin and never send AI-HIVE credentials to a custom origin automatically.
-
Require explicit confirmation for non-default endpoints. A custom server should require a separate credential variable and a clear warning rather than reusing
AI_HIVE_API_KEYorAI_HIVE_ACCESS_TOKEN. -
Disable cross-origin redirect credential forwarding. Use a redirect handler that rejects redirects for authenticated requests, or strips credentials and requires reauthorization after validating the new destination.
-
Apply least-privilege credentials. Prefer narrowly scoped, short-lived OAuth tokens where supported. Retain the documented revocation procedure and advise immediate revocation after suspected exposure.
-
Add automated security tests. Verify that HTTP URLs, deceptive subdomains, alternate ports, embedded credentials, and cross-origin redirects cannot receive AI-HIVE authentication headers.