T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Environment-Controlled MCP Endpoint Can Receive AI-HIVE Credentials and Tool Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 47–70
Vulnerability Type: Unrestricted authenticated endpoint override
Risk Level: MediumVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination is read from the
AI_HIVE_MCP_URLenvironment variable, but the value is not validated before an API key or bearer token is attached to the request. The implementation does not require HTTPS, enforce the documentedai-hive.iclip.cnhost and/api/mcppath, or otherwise establish that the recipient is an authorized AI-HIVE endpoint.Consequently, an attacker who can influence the process environment or launcher configuration can redirect authenticated MCP requests to an arbitrary server. The request body can also contain MCP initialization data, tool names, prompts, task identifiers, asset references, and other tool arguments.
Remote networking itself is necessary for the Skill’s declared MCP functionality. However, sending credentials to an ...[truncated 1605 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
AI_HIVE_MCP_URLconfigurability if custom endpoints are not required. - If configurability is necessary, parse the URL and enforce:
- The
httpsscheme. - The exact approved hostname, such as
ai-hive.iclip.cn. - The expected port.
- The expected
/api/mcppath. - No embedded username or password.
- The
- Refuse to attach credentials unless the destination passes the allowlist.
- Add explicit redirect handling and reject redirects to a different origin before forwarding authorization headers.
- Separate endpoint selection from credential construction so credentials cannot be generated for an untrusted origin.
- Consider certificate pinning or an equivalent stronger trust policy where operationally appropriate.
- Add automated tests covering HTTP URLs, look-alike domains, user-info URL tricks, unexpected ports, alternate paths, and cross-origin redirects.
- Document that endpoint overrides must not be accepted from untrusted project-level environment files or launcher configurations.
A suitable validation pattern is:
python from urllib.parse import urlparse EXPECTED_HOST = "ai-hive.iclip.cn" EXPECTED_PATH = "/api/mcp" def validated_mcp_url(raw_url: str) -> str: parsed = urlparse(raw_url) if ( parsed.scheme != "https" or parsed.hostname != EXPECTED_HOST or parsed.port not in (None, 443) or parsed.path != EXPECTED_PATH or parsed.params or parsed.query or parsed.fragment or parsed.username or parsed.password ): raise SystemExit("Refusing to send credentials to an unapproved MCP endpoint.") return raw_urlCredential headers should only be added after this validation succeeds.
- Remove