T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Environment-Controlled MCP Endpoint Can Expose AI-HIVE Credentials
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 47–75
Vulnerability Type: Credential disclosure through an unvalidated, environment-controlled network destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination is read from the
AI_HIVE_MCP_URLenvironment variable, but the script does not validate its scheme, hostname, port, or path before attaching an AI-HIVE API key or OAuth bearer token.Consequently, any authenticated
list-toolsorcalloperation sends the credential to whichever destination is configured in that variable. The documented functionality consistently useshttps://ai-hive.iclip.cn/api/mcp, so allowing arbitrary authenticated destinations exceeds the minimum privilege and configurability required by the declared workflow.Python's
urllibredirect behavior may also allow an authenticated request to be redirected. ...[truncated 1780 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
AI_HIVE_MCP_URLconfigurability if alternate endpoints are not a documented requirement:python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" -
If endpoint configuration is required, validate it before constructing authenticated requests:
- Require the
httpsscheme. - Require the exact expected hostname.
- Reject embedded user information.
- Permit only the expected port.
- Require the expected MCP path.
- Reject fragments and unexpected query parameters.
- Require the
-
Bind credentials to an explicit origin allowlist. Do not attach AI-HIVE credentials to any URL other than the approved AI-HIVE origin.
-
Disable automatic redirects for authenticated requests, or validate every redirect target and reject any origin change.
-
Fail closed with a clear error when validation fails. Do not retry against a fallback or user-supplied destination while retaining authentication headers.
-
Prefer OAuth tokens with narrowly scoped permissions and short lifetimes. Ensure API keys can be scoped to only the tools required by this Skill.
-
Add regression tests confirming that:
- HTTP endpoints are rejected.
- Alternate hosts, ports, and paths are rejected.
- Cross-origin redirects are rejected.
- No credential header is emitted before destination validation succeeds.
-
If exposure is suspected, immediately revoke the affected API key or OAuth authorization and remove the hostile environment configuration.
-