T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Environment-Controlled MCP Endpoint Can Exfiltrate API Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19–74
Vulnerability Type: Credential disclosure through an unvalidated network destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "Missing credentials. OAuth users should complete login in their MCP client; " "tool calls from this script require AI_HIVE_API_KEY, or run doctor only." ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload( response.read(), response.headers.get("content-type", ""), ) return result, response.headers.get("mcp-session-id") or session_idThe English text in the first snippet above is a translation of the original user-facing error message; the executable credential and request logic is reproduced without semantic alteration.
Technical Analysis
The script accepts the authenticated MCP destination from the
AI_HIVE_MCP_URLenvironment variable. Before attaching credentials, it does not validate:- That the URL uses HTTPS.
- That the hostname ...[truncated 2614 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the endpoint override if it is not required. Use a fixed MCP endpoint:
python MCP_URL = "https://ai-hive.iclip.cn/api/mcp"-
If customization is required, validate the destination before attaching credentials. Require all of the following:
- Scheme is exactly
https. - Hostname is exactly
ai-hive.iclip.cn. - Port is absent or equals
443. - Path is exactly
/api/mcp. - URL contains no embedded username or password.
- Redirects cannot leave the approved origin.
- Scheme is exactly
-
Do not forward AI-HIVE credentials to development or custom endpoints. Use separate test credentials and an explicit development mode if non-production servers must be supported.
-
Disable or strictly validate redirects. A trusted initial URL must not be allowed to redirect an authenticated request to another origin.
-
Fail closed. Reject malformed URLs, plaintext HTTP, alternate ports, deceptive subdomains such as
ai-hive.iclip.cn.attacker.example, and any destination outside the allowlist before callingauth_headers(). -
Add automated security tests covering:
- HTTP destinations.
- Unapproved hosts and subdomains.
- Embedded user information.
- Alternate ports.
- Unicode or encoded hostname confusion.
- Cross-origin redirects.
- Missing or unexpected paths.
-
Rotate exposed credentials if the script has previously been run with an untrusted
AI_HIVE_MCP_URL.