T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Environment-Controlled MCP Endpoint Can Expose Authentication Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 45–74
Vulnerability Type: Arbitrary authenticated endpoint caused by an unrestricted environment-variable override
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response:Technical Analysis
The script permits
AI_HIVE_MCP_URLto replace the declared AI-HIVE service URL without validating the scheme, hostname, port, or final redirect destination. The same request code unconditionally adds either theAI_HIVE_API_KEYvalue or an OAuth bearer token to the outbound request.Consequently, whoever controls the process environment can redirect authenticated requests to an arbitrary endpoint. The code does not require HTTPS, restrict the destination to
ai-hive.iclip.cn, or prevent cross-origin redirects. This behavior exceeds the minimum privileges required for ...[truncated 1468 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove the
AI_HIVE_MCP_URLoverride if alternate endpoints are not required:python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If configurability is necessary, validate the URL before adding credentials:
- Require the
httpsscheme. - Allowlist the exact hostname
ai-hive.iclip.cn. - Require the expected
/api/mcppath. - Reject user information embedded in the URL.
- Reject unexpected ports.
- Normalize and validate the parsed hostname rather than using substring checks.
- Require the
-
Prevent credential forwarding across redirects. Disable automatic redirects for authenticated requests or validate every redirect target before following it.
-
Separate destination validation from request construction and only call
auth_headers()after the destination has passed validation. -
Require an explicit command-line confirmation for any non-production endpoint and do not send production credentials to test or custom endpoints.
-
Add automated tests covering HTTP URLs, lookalike domains, subdomain tricks, embedded credentials, nonstandard ports, and cross-origin redirects.
-
If exploitation is suspected, immediately revoke the exposed API key or OAuth authorization, clear affected environment variables, and review AI-HIVE task and billing history.
-