T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Unvalidated MCP Endpoint Override Can Expose Authentication Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 47–72
Vulnerability Type: Credential disclosure through an untrusted network destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination can be overridden through the
AI_HIVE_MCP_URLenvironment variable. The value is used without validating its scheme, hostname, port, or path. At the same time,post()unconditionally obtains authentication headers and attaches either an OAuth bearer token or an AI-HIVE API key to requests sent to that destination.Consequently, control over the process environment or launch configuration can redirect authenticated requests to an attacker-controlled server. The code also does not explicitly require HTTPS, so an override using plaintext HTTP would expose credentials and request content in transit.
The network access itself is necessary for the Skill's declared remote AI-HIVE functionality. However, transmitting service credenti ...[truncated 1641 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
AI_HIVE_MCP_URLoverride if custom endpoints are not required. - If endpoint customization is required, parse the URL and enforce:
- The
httpsscheme. - An explicit allowlist of trusted hostnames.
- The expected port and MCP path.
- No embedded user information or URL fragments.
- The
- Refuse to attach
Authorizationorx-ai-hive-api-keyheaders unless the final destination exactly matches an approved origin. - Prevent cross-origin credential forwarding after redirects, or disable redirects for authenticated MCP requests.
- Separate development endpoint support from production operation. Require an explicit development flag and disable real credentials for non-production destinations by default.
- Prefer a fixed constant for the production endpoint and fail closed when URL validation fails.
- Add automated tests covering malicious overrides, plaintext HTTP, unexpected ports, lookalike domains, embedded credentials, and cross-origin redirects.
A suitable validation pattern would compare the parsed scheme, normalized hostname, port, and path against a fixed allowlist before constructing any authenticated request.
- Remove the