T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ai_hive_mcp.py:19- Finding
Unrestricted MCP Endpoint Override Can Expose Authentication Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 46–74
Vulnerability Type: Unvalidated credential destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "Missing credentials. OAuth users should complete login in their MCP " "client; this script requires AI_HIVE_API_KEY for tool calls, or run " "doctor only." ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload( response.read(), response.headers.get("content-type", ""), ) return result, response.headers.get("mcp-session-id") or session_idTechnical Analysis
The MCP destination is read directly from the attacker-influenceable
AI_HIVE_MCP_URLenvironment variable. The value is not parsed or validated before the client attaches either anAI_HIVE_ACCESS_TOKENbearer credential or anAI_HIVE_API_KEY.The implementation does not:
- Require HTTPS.
- Restrict the ...[truncated 2372 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
AI_HIVE_MCP_URLconfigurability if custom endpoints are not an explicit functional requirement. - If endpoint overrides are required, parse the URL and enforce:
- The
httpsscheme. - An explicit hostname allowlist, normally only
ai-hive.iclip.cn. - The expected port and MCP path.
- No username, password, fragment, or ambiguous hostname encoding.
- The
- Never attach AI-HIVE credentials to an endpoint outside the approved origin. Fail closed before constructing the request.
- Disable automatic redirects for authenticated requests, or manually validate every redirect target and strip credentials whenever the origin changes.
- Require explicit interactive confirmation for any approved non-default endpoint and clearly display the exact credential destination.
- Make
doctor()inspect and validate the same endpoint used bypost()rather than fixed metadata URLs that may not correspond to an override. - Prefer short-lived, narrowly scoped OAuth tokens over long-lived API keys where the client supports OAuth.
- Add automated tests covering malicious hosts, plaintext HTTP URLs, embedded credentials, unexpected ports, deceptive hostname suffixes, and cross-origin redirects.
- Remove