T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:18
- Finding
- Environment-Overridable MCP Endpoint Can Exfiltrate Credentials and Request Data## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 18 and 46–75 **Vulnerability Type**: Unvalidated authenticated request destination **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: ``` ### Technical Analysis The script allows `AI_HIVE_MCP_URL` to replace the declared AI-HIVE endpoint. It does not validate the resulting URL's scheme, hostname, port, user information, or relationship to the expected service origin. Independently, `auth_headers()` obtains either a bearer access token or an AI-HIVE API key from the environment. `post()` unconditionally attaches that credential to requests sent to `MCP_URL`. Tool arguments are serialized into the same outbound request. Consequently, control over the process environment also grants control over the destination receiving the user's credential and MCP payload. The implemen ...[truncated 1905 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `AI_HIVE_MCP_URL` override if custom endpoints are not required. 2. If an override is required, parse it with `urllib.parse.urlsplit` and enforce: - The `https` scheme. - The exact trusted hostname `ai-hive.iclip.cn`. - The expected port or default HTTPS port. - No embedded username or password. - The expected MCP path. 3. Bind authentication headers to the validated AI-HIVE origin. Never attach an API key or bearer token to an untrusted or unrecognized host. 4. If development endpoints must be supported, require a separate explicit option such as `--allow-custom-endpoint`, display the resolved destination, and prohibit using production credentials with it. 5. Fail closed when URL parsing or validation is ambiguous. 6. Consider certificate pinning or equivalent endpoint-authentication hardening where the deployment environment and certificate-rotation process permit it. 7. Use narrowly scoped, revocable credentials with spending limits and short lifetimes where supported. 8. Add automated tests confirming that HTTP URLs, alternate hosts, embedded credentials, unexpected ports, and deceptive subdomains are rejected before authentication headers are constructed or transmitted.