T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:19
- Finding
- Credentials Can Be Exfiltrated Through an Environment-Controlled MCP Endpoint## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 19 and 47–69 **Vulnerability Type**: Credential disclosure through an untrusted network destination **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "Missing credentials. OAuth users should complete login in their MCP " "client; this script requires AI_HIVE_API_KEY when invoking tools, " "or run doctor without credentials." ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` The English rendering of the exception message above is provided for readability; the executable credential and request logic is unchanged. ### Technical Analysis The MCP request destination is taken from the `AI_HIVE_MCP_URL` environment variable, but the script does not validate its scheme, hostname, port, or path. At the same time, `auth_headers()` automatically reads `AI_HIVE_ACCESS_TOKEN` or `AI_HIVE_API_KEY` and attaches the credential to every MCP POST request. Consequently, the security boundary for the credential is determined by an environment variable rather than by the fixed AI-HIV ...[truncated 2060 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `AI_HIVE_MCP_URL` override if custom MCP servers are not required, and use the fixed declared endpoint: ```python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" ``` 2. If endpoint customization is required, parse the URL with `urllib.parse.urlsplit` and enforce: - The `https` scheme. - An explicit allowlist of trusted hostnames. - The expected port and MCP path. - No embedded username or password. - No redirects to a different origin. 3. Bind credentials to an expected origin. Do not call `auth_headers()` or attach sensitive headers until the destination has passed validation. 4. Require an explicit, interactive confirmation before sending credentials to any non-default endpoint. Display the normalized destination without displaying the credential. 5. Disable automatic cross-origin redirect following for credential-bearing requests, or verify every redirect target before forwarding authentication headers. 6. Prefer short-lived, narrowly scoped OAuth credentials over long-lived API keys. Revoke and rotate any credential suspected of exposure. 7. Add automated tests confirming that HTTP URLs, alternate hosts, deceptive subdomains, embedded credentials, unexpected ports, and cross-origin redirects are rejected.