T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ai_hive_mcp.py:19
- Finding
- Credential Disclosure Through an Unvalidated MCP Endpoint Override## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 19 and 47–71 **Vulnerability Type**: Unvalidated credential destination **Risk Level**: Medium ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The client reads an API key or OAuth access token from the process environment and attaches it to every authenticated MCP request. However, the destination is independently controlled by the `AI_HIVE_MCP_URL` environment variable. The code does not require HTTPS, verify that the hostname is `ai-hive.iclip.cn`, restrict the URL path to `/api/mcp`, or otherwise bind AI-HIVE credentials to their intended origin. Therefore, a malicious or accidentally modified environment can redirect authenticated requests to an arbitrary server. This exceeds the minimum privileges needed for the declared functionality. The Skill documents a specific AI-HIVE endpoint, so transmitting AI-HIVE credentials to arbitrary conf ...[truncated 1326 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `AI_HIVE_MCP_URL` override if custom MCP endpoints are not required: ```python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" ``` 2. If configurability is required, validate the URL before constructing an authenticated request: - Require the `https` scheme. - Require an exact allowlisted hostname. - Require the expected port and `/api/mcp` path. - Reject embedded user information, fragments, and ambiguous hostnames. 3. Prevent credential forwarding across redirects. Disable automatic redirects for authenticated requests or verify every redirect target against the same origin allowlist before resending credentials. 4. Bind each credential to its intended endpoint. Custom servers should use separately named credential variables rather than automatically receiving `AI_HIVE_API_KEY` or `AI_HIVE_ACCESS_TOKEN`. 5. Fail closed with a clear error when the endpoint does not match the approved AI-HIVE origin. 6. Add tests covering HTTP URLs, attacker-controlled domains, deceptive subdomains, alternate ports, embedded credentials, and cross-origin redirects. 7. If a credential may already have been exposed, revoke it immediately, create a replacement, and inspect account activity and billing records for unauthorized operations.