T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:17- Finding
Credential Disclosure Through an Unrestricted MCP Endpoint Override
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 17 and 48–69
Vulnerability Type: Credential exfiltration through an attacker-controlled network endpoint
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The authenticated request destination is read from the
AI_HIVE_MCP_URLenvironment variable without validating its scheme, hostname, port, or path. The same request automatically includes either the bearer token fromAI_HIVE_ACCESS_TOKENor the API key fromAI_HIVE_API_KEY.Consequently, any party capable of influencing the process environment or launch configuration can redirect authenticated requests away from the documented AI-HIVE service. The override may point to an attacker-controlled HTTP or HTTPS endpoint, causing the secret to be transmitted in the
Authorizationorx-ai-hive-api-keyheader.Endpoint configurability is not required by the declared ...[truncated 1931 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the
AI_HIVE_MCP_URLoverride for normal authenticated operation and pin the destination to:https://ai-hive.iclip.cn/api/mcp. -
If endpoint configurability is operationally necessary, parse and validate the URL before reading or attaching any credential. Require all of the following:
- Scheme exactly
https. - Hostname exactly
ai-hive.iclip.cn. - Default HTTPS port only.
- Path exactly
/api/mcp. - No embedded username or password.
- No unapproved query string or fragment.
- Scheme exactly
-
Disable automatic cross-origin redirects for authenticated requests. If redirects must be supported, validate every redirect target against the same origin allowlist before forwarding credentials.
-
Separate development support from production operation. Custom endpoints should require an explicit unsafe-development flag and isolated test credentials that cannot invoke production or paid tools.
-
Scope credentials server-side to the minimum required tools and operations. Prefer short-lived OAuth tokens over long-lived API keys, and separate read-only credentials from credentials capable of paid generation.
-
Add automated tests confirming that credentials are never sent when:
- The URL uses plaintext HTTP.
- The hostname differs from
ai-hive.iclip.cn. - The port or path is changed.
- A same-origin endpoint redirects to a different origin.
-
Document immediate key revocation and token invalidation procedures for users who may have executed the client with an untrusted endpoint override.
-