T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:19
- Finding
- Environment-Controlled MCP Endpoint Can Expose Authentication Credentials## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 19–76 **Vulnerability Type**: Unvalidated network destination for authenticated requests **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} ``` ```python def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_id ``` ### Technical Analysis The MCP destination can be overridden through the `AI_HIVE_MCP_URL` environment variable without validation of its scheme, hostname, port, or path. The `post()` function then unconditionally attaches either the `AI_HIVE_ACCESS_TOKEN` bearer token or the `AI_HIVE_API_KEY` to requests sent to that destination. Consequently, an attacker who can influence the process environment or launch configuration can redirect authenticated requests away from the documented AI-HIVE endpoint. The implementation also does not require HTTPS, so an o ...[truncated 1974 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `AI_HIVE_MCP_URL` override if custom endpoints are not required, and use the fixed documented endpoint: ```python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" ``` 2. If endpoint configurability is required, validate the parsed URL before attaching credentials: - Require the `https` scheme. - Allowlist the exact hostname `ai-hive.iclip.cn`. - Require the expected `/api/mcp` path. - Reject embedded user information, unexpected ports, fragments, and malformed URLs. 3. Disable automatic redirects or verify that every redirect remains on the approved HTTPS origin before forwarding authentication headers. 4. Separate development and production behavior. Custom development endpoints should require an explicit development flag and must not receive production API keys or access tokens. 5. Apply least privilege to credentials: - Prefer OAuth with narrowly scoped, revocable tokens. - Use separate credentials for development and production. - Rotate credentials immediately if endpoint redirection or disclosure is suspected. 6. Add automated tests confirming that credentials are never sent when: - The URL uses plaintext HTTP. - The hostname differs from the approved service. - The path or port is unexpected. - A redirect targets another origin.