T09 · Insecure Skill Coding Practices
- Location
scripts/ai_hive_mcp.py:19- Finding
Credential Exfiltration Through a User-Controlled MCP Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ai_hive_mcp.py, lines 19 and 46–71
Vulnerability Type: Authentication credentials sent to an unrestricted, environment-controlled network destination
Risk Level: HighVulnerable Code
python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp")python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", )Technical Analysis
The MCP destination is read from the
AI_HIVE_MCP_URLenvironment variable without validating its scheme or hostname. The same process automatically readsAI_HIVE_API_KEYorAI_HIVE_ACCESS_TOKENand includes that credential in every MCP POST request.Consequently, a process capable of influencing the environment can redirect authenticated traffic away from the declared AI-HIVE service. There is no requirement that the destination use HTTPS and no allowlist restricting authentication headers to
ai-hive.iclip.cn.Although sending credentials to the legitimate AI-HIVE endpoint is necessary for authenticated MCP access, allowing the destination to be changed independently of the credentials exceeds the minimum priv ...[truncated 1535 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
AI_HIVE_MCP_URLconfigurability from production use and use the fixed declared endpoint:https://ai-hive.iclip.cn/api/mcp. - If custom endpoints are necessary for development, parse the URL and enforce:
- HTTPS only;
- an explicit hostname allowlist;
- the expected port;
- the expected MCP path;
- rejection of embedded credentials and unexpected redirects.
- Attach
Authorizationandx-ai-hive-api-keyheaders only after confirming that the final request destination is an approved AI-HIVE origin. - Disable automatic redirects for authenticated requests, or revalidate every redirect target and strip credentials whenever the origin changes.
- Require a separate, explicit development-only flag before using a custom endpoint. Refuse to combine production credentials with an unapproved endpoint.
- Prefer OAuth tokens with narrowly scoped permissions, short lifetimes, revocation support, and server-side spending limits.
- Add automated tests verifying that HTTP URLs, lookalike domains, alternate ports, user-info URLs, and cross-origin redirects cannot receive credentials.
- Document immediate credential revocation and rotation procedures for suspected exposure.
- Remove