T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:17
- Finding
- Arbitrary MCP Endpoint Override Can Exfiltrate API Credentials## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 17 and 51-74 **Vulnerability Type**: Credential exfiltration through an unvalidated network destination **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} ``` ```python def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_id ``` ### Technical Analysis The destination used for authenticated MCP requests is taken directly from the `AI_HIVE_MCP_URL` environment variable. The code does not validate the URL scheme, hostname, port, or origin before attaching either an AI-HIVE bearer token or API key. Consequently, anyone able to influence the process environment or launch configuration can redirect authenticated requests from the intended AI-HIVE service to an attacker-controlled endpoint. This behavior is unnecessary for the Skill's declared operation because its documented MCP endpo ...[truncated 1737 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `AI_HIVE_MCP_URL` override if alternate endpoints are not required: ```python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" ``` 2. If endpoint configurability is required, parse and validate the destination before constructing the request: - Require HTTPS. - Require the exact approved hostname `ai-hive.iclip.cn`. - Require the expected path `/api/mcp`. - Reject embedded usernames or passwords. - Reject fragments and unexpected query parameters. - Reject nonstandard ports unless explicitly approved. - Compare normalized hostnames rather than relying on string prefixes. 3. Maintain an explicit destination allowlist and fail closed when validation fails. 4. Disable automatic redirects for authenticated requests, or validate every redirect destination before forwarding credentials. Never forward authorization headers across origins. 5. Separate endpoint selection from credential attachment. Only attach `Authorization` or `x-ai-hive-api-key` after confirming that the final request origin is trusted. 6. Prefer short-lived, narrowly scoped OAuth tokens over long-lived API keys where supported. 7. Add automated tests confirming that credentials are not sent when: - The endpoint uses HTTP. - The hostname differs from the approved service. - A deceptive hostname such as `ai-hive.iclip.cn.attacker.example` is supplied. - The URL contains user information or an unexpected port. - The server returns a cross-origin redirect. 8. Document credential rotation procedures and instruct affected users to revoke any key or token that may have been used with an untrusted endpoint.