T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:19
- Finding
- User-Controlled MCP Endpoint Can Receive Authentication Credentials and Task Data## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 19 and 47–75 **Vulnerability Type**: Unrestricted authenticated endpoint override **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The script permits `AI_HIVE_MCP_URL` to replace the trusted AI-HIVE endpoint without validating the URL scheme, hostname, port, or destination identity. The `post()` function then unconditionally adds either the bearer access token or API key returned by `auth_headers()` to requests sent to that endpoint. Consequently, an environment variable intended as a configuration override also controls where authentication credentials and MCP request payloads are disclosed. The code does not require HTTPS, restrict the endpoint to `ai-hive.iclip.cn`, or request explicit approval when the configured destination differs from the default. Sending credentials and task data to the documented AI-HIVE HTTPS endpoint is necessary for the declared authenticated MCP functionality. Allow ...[truncated 1597 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `AI_HIVE_MCP_URL` configurability if custom endpoints are not a documented requirement, and use the fixed trusted HTTPS endpoint. 2. If endpoint overrides are required, parse the URL before creating the request and enforce: - The `https` scheme. - An explicit hostname allowlist, preferably only `ai-hive.iclip.cn`. - The expected path, `/api/mcp`. - No embedded username or password. - No unexpected port. 3. Never attach AI-HIVE credentials to an endpoint that fails validation. 4. Require an explicit, interactive confirmation for any non-default destination, clearly stating that credentials and task payloads will be sent to that host. 5. Separate endpoint configuration from credential forwarding. Custom development endpoints should use distinct, endpoint-specific credentials rather than production AI-HIVE credentials. 6. Consider certificate or public-key pinning in controlled deployments where the operational trade-offs are acceptable. 7. Add automated tests covering malicious overrides such as plaintext HTTP, look-alike domains, embedded credentials, alternate ports, and attacker-controlled hosts. 8. Document that environment variables are part of the security boundary and should not be accepted from untrusted launchers, repositories, or CI jobs.