T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ai_hive_mcp.py:16
- Finding
- Environment-Controlled MCP Endpoint Can Receive AI-HIVE Credentials## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 16 and 43–75 **Vulnerability Type**: Unvalidated destination for authenticated network requests **Risk Level**: Medium ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) try: with urllib.request.urlopen(request, timeout=60) as response: result = parse_payload(response.read(), response.headers.get("content-type", "")) return result, response.headers.get("mcp-session-id") or session_id except urllib.error.HTTPError as error: body = error.read().decode("utf-8", errors="replace") if error.code == 401: raise SystemExit( "AI-HIVE MCP returned 401. Verify that the API key is complete and has not been revoked." ) raise SystemExit(f"AI-HIVE MCP HTTP {error.code}: {body[:800]}") ``` ### Technical Analysis The MCP destination is taken directly from the process env ...[truncated 2252 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `AI_HIVE_MCP_URL` configurability if alternate MCP endpoints are not an explicit requirement. 2. If configurability is required, parse the URL and enforce: - The `https` scheme. - The exact approved hostname, such as `ai-hive.iclip.cn`. - The expected port. - The expected `/api/mcp` path. - No embedded username or password. 3. Reject unknown hosts before calling `auth_headers()` or constructing an authenticated request. 4. Use a redirect policy that denies cross-origin redirects for authenticated requests. Never forward API-key or bearer-token headers to another origin. 5. Consider separating destination validation from request construction and add tests covering HTTP URLs, look-alike domains, embedded credentials, alternate ports, and redirects. 6. Keep API keys and tokens in a secret manager or protected environment and revoke them immediately if destination manipulation is suspected.