T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ai_hive_mcp.py:19- Finding
Credential Exfiltration Through a User-Controlled MCP Endpoint
- Content
View full analysis
dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} ``` ```python def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_id ``` ### Technical Analysis The MCP request destination is taken directly from the `AI_HIVE_MCP_URL` environment variable. The code then obtains an AI-HIVE API key or OAuth access token from the process environment and unconditionally attaches that credential to requests sent to the configured destination. There is no validation that the destination: - Uses HTTPS. - Has the expected `ai-hive.iclip.cn` hostname. - Uses the intended `/api/mcp` path. - Resolves to an approved public network address. - Has not been changed to a third-party endpoint. Consequently, the authentication credential and MCP request body can be transmitted to an arbitrary ...[truncated 2085 chars]- Remediation
View remediation
str: parsed = urlparse(url) if ( parsed.scheme != "https" or parsed.hostname != EXPECTED_HOST or parsed.port not in (None, 443) or parsed.path.rstrip("/") != EXPECTED_PATH or parsed.username is not None or parsed.password is not None ): raise SystemExit("Refusing to send AI-HIVE credentials to an unapproved endpoint.") return url ``` 3. Perform destination validation before calling `auth_headers()`. 4. Do not attach AI-HIVE credentials to custom or third-party endpoints. If custom MCP servers must be supported, require separate endpoint-specific credentials rather than reusing `AI_HIVE_API_KEY` or `AI_HIVE_ACCESS_TOKEN`. 5. Restrict authenticated redirects. Reject any redirect that changes the scheme, hostname, port, or approved path before resending a request. 6. Require explicit interactive confirmation when any non-default endpoint is selected, displaying the normalized destination without displaying credentials. 7. Add automated tests verifying that HTTP URLs, alternate hosts, embedded credentials, unexpected ports, deceptive subdomains, and cross-origin redirects are rejected. 8. Document that environment variables controlling authenticated destinations must not be accepted from untrusted project files, wrappers, or launch configurations. ]]>