T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:19
- Finding
- Environment-Controlled MCP Endpoint Can Exfiltrate API Credentials## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 19 and 47–74 **Vulnerability Type**: Credential disclosure through an unvalidated destination **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} ``` ```python def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The MCP destination is read from the environment variable `AI_HIVE_MCP_URL`, but the value is not validated before authenticated requests are sent. The `post()` function unconditionally adds either the bearer access token or the API key returned by `auth_headers()`. Consequently, an environment value can redirect authenticated traffic away from the declared AI-HIVE service. There is no enforcement of HTTPS, no hostname allowlist, no expected-origin comparison, and no rejection of embedded credentials, unexpected ports, or attacker-controlled hosts. An endpoint override can be useful for testing, but forwarding production credentials to an arbitrary override exceeds the minimum privilege necessary for the Skill's declared AI-HIVE functionality. The legitimate operation only requires credentials to be transmitted to the trusted AI-HIVE MCP origin. ### Att ...[truncated 1618 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `AI_HIVE_MCP_URL` overriding if custom endpoints are not necessary. Use the fixed declared endpoint: `https://ai-hive.iclip.cn/api/mcp`. 2. If overriding is required for development, parse and validate the URL before creating a request: - Require the `https` scheme. - Allow only an explicit set of trusted hostnames. - Reject embedded usernames or passwords. - Reject unexpected ports. - Normalize the hostname before comparison. - Verify that credentials are only attached when the destination matches a trusted origin. 3. Separate endpoint selection from credential attachment. For example, permit custom endpoints only in an explicit unauthenticated development mode, and refuse to send `AI_HIVE_API_KEY` or `AI_HIVE_ACCESS_TOKEN` to them. 4. Fail closed with a clear error when the endpoint is not trusted rather than silently sending an unauthenticated request or accepting arbitrary destinations. 5. Add automated tests covering: - The default trusted endpoint. - HTTP downgrade attempts. - Subdomain and suffix-confusion hosts. - Embedded credentials. - Unexpected ports. - Internationalized or encoded hostnames. - Attempts to send credentials to a non-allowlisted origin. 6. Document the endpoint trust restriction and advise affected users to revoke and rotate any credential that may already have been sent to an untrusted endpoint.