T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ai_hive_mcp.py:17- Finding
Credential Exfiltration Through an Unrestricted MCP Endpoint Override
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 17 and 47–74
Vulnerability Type: Credential exposure through an unvalidated network destination
Risk Level: MediumVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_idTechnical Analysis
The MCP destination can be replaced through the
AI_HIVE_MCP_URLenvironment variable. No validation ensures that the resulting URL:- Uses HTTPS.
- Targets the documented
ai-hive.iclip.cnhost. - Uses an approved port and path.
- Contains no embedded user information.
- Remains on an approved origin after redirects.
The
post()function independently obtains an OAuth bearer token or API key from the envi ...[truncated 1834 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
AI_HIVE_MCP_URLoverride support if custom servers are not required and use the documented constant endpoint exclusively. - If endpoint overrides are required, parse the URL with
urllib.parse.urlsplitand enforce:- Scheme exactly equal to
https. - Hostname exactly equal to
ai-hive.iclip.cn, or a narrowly defined allowlist. - No embedded username or password.
- Only approved ports and MCP paths.
- Scheme exactly equal to
- Do not attach AI-HIVE credentials when the destination origin differs from the approved AI-HIVE origin.
- Disable automatic redirects for authenticated requests, or validate every redirect target before forwarding credentials.
- Require explicit user confirmation before sending credentials to any non-default endpoint.
- Prefer short-lived, narrowly scoped OAuth tokens over long-lived API keys.
- Ensure server-side credentials have minimum required scopes, spending controls, revocation support, and suitable expiration.
- Add automated tests confirming that HTTP URLs, deceptive subdomains, embedded credentials, unapproved ports, and cross-origin redirects are rejected.
- Remove