T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ai_hive_mcp.py:17
- Finding
- Credential Disclosure Through a User-Controlled MCP Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ai_hive_mcp.py`, lines 17 and 47-70 **Vulnerability Type**: Credential exfiltration through an unvalidated network destination **Risk Level**: High ### Vulnerable Code ```python MCP_URL = os.environ.get("AI_HIVE_MCP_URL", "https://ai-hive.iclip.cn/api/mcp") ``` ```python def auth_headers() -> dict[str, str]: key = os.environ.get("AI_HIVE_API_KEY", "").strip() token = os.environ.get("AI_HIVE_ACCESS_TOKEN", "").strip() if token: return {"authorization": f"Bearer {token}"} if key: return {"x-ai-hive-api-key": key} raise SystemExit( "缺少凭据。OAuth 用户请在 MCP 客户端中完成登录；本脚本调用工具时需通过环境变量提供 " "AI_HIVE_API_KEY，或仅运行 doctor。" ) def post(payload: dict, session_id: str | None = None) -> tuple[dict, str | None]: headers = { "content-type": "application/json", "accept": "application/json, text/event-stream", **auth_headers(), } if session_id: headers["mcp-session-id"] = session_id request = urllib.request.Request( MCP_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers=headers, method="POST", ) ``` ### Technical Analysis The MCP destination is taken directly from the `AI_HIVE_MCP_URL` environment variable. The value is not validated for its scheme, hostname, port, embedded credentials, or relationship to the expected AI-HIVE origin. At the same time, `auth_headers()` retrieves an API key or OAuth access token and `post()` unconditionally attaches that credential to requests sent to `MCP_URL`. Consequently, anyone able to influence the process environment or launch configuration can redirect authenticated requests to an arbitrary server. Supporting a configurable destination is not necessary for the Skill's declared operation against `https://ai-hive.iclip.cn/api/mcp`. This configuration therefore exceeds the minimum flexibility required and creates a c ...[truncated 2041 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove unnecessary endpoint configurability.** Use a fixed constant when the helper is intended exclusively for AI-HIVE: ```python MCP_URL = "https://ai-hive.iclip.cn/api/mcp" ``` 2. **If endpoint configuration must remain, validate it before loading or attaching credentials.** Require: - Scheme: exactly `https`. - Hostname: exactly `ai-hive.iclip.cn`. - Path: exactly `/api/mcp`. - No embedded username or password. - No fragment or unexpected port. 3. **Bind credentials to an approved origin.** Do not call `auth_headers()` unless the validated request origin matches the origin for which the credential was issued. 4. **Control redirects.** Reject redirects to a different origin and ensure authorization or API-key headers are never forwarded across origins. 5. **Fail closed.** If validation fails, terminate before constructing or sending an authenticated request. Do not silently fall back to the supplied URL. 6. **Separate custom-server credentials.** If arbitrary MCP servers are an intentional feature, require distinct credentials configured for each approved origin rather than reusing `AI_HIVE_API_KEY` or `AI_HIVE_ACCESS_TOKEN`. 7. **Add automated security tests.** Verify that HTTP URLs, lookalike domains, subdomains, embedded credentials, alternate ports, and cross-origin redirects are rejected before any sensitive header is transmitted. 8. **Document credential response procedures.** Users who may have executed the helper with an untrusted `AI_HIVE_MCP_URL` should revoke and rotate the affected API key or OAuth authorization and review account activity. ]]>