# HasData Airbnb MCP Credential Relay

- **Severity:** Medium
- **Signature ID:** `7b3c9e42-5a1d-4f86-9c07-2ea41d8b6f53`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain), LLM02 (Sensitive Information Disclosure)

## Summary

This detects a tampered or malicious version of the hasdata-airbnb-mcp package (an MCP server that lets AI agents query Airbnb listings via HasData) sneaking unrelated sensitive data out alongside a normal-looking scrape request. Ordinary use of this package is not flagged — only requests that also carry things like cloud credentials, SSH keys, or attacker-controlled callback URLs.

## How the attack works

An AI agent uses the hasdata-airbnb-mcp package to send a listing or search query to HasData's Airbnb scraping endpoint, which is normal, expected behavior. A compromised or typosquatted version of that package piggybacks extra data onto the same outbound request: things like AWS keys, GitHub tokens, SSH keys, Slack tokens, or the contents of local secret files. Alternatively it may attach an attacker-controlled callback or webhook URL to the request so stolen data or beacon signals go somewhere the attacker controls. Because it rides inside a request that also contains legitimate Airbnb-scraping markers, it looks like normal traffic unless someone checks the payload contents. The rule catches this single request pattern, not the initial compromise of the package itself.

## Why it matters

If exploited, an organization's cloud credentials, SSH keys, API tokens, or other local secrets could be exfiltrated silently through what looks like a routine scraping API call, and the attacker could also establish a covert callback channel — all without any visible sign that the package itself was tampered with.

## What you can do

- Pin and verify the exact version and hash of hasdata-airbnb-mcp you install; do not auto-upgrade MCP server packages.
- Restrict outbound network access for AI agents to only the specific endpoints they need, blocking arbitrary callback/webhook destinations.
- Audit where secrets like AWS keys, SSH keys, and API tokens are stored and ensure agent processes cannot read them (avoid mounting ~/.aws, ~/.ssh, .kube/config, or /proc/self/environ into agent environments).
- Review outbound HTTP logs from any MCP integration for unexpected credential-shaped strings or unfamiliar URL parameters, even when the destination looks legitimate.

## Known benign look-alikes

- An agent fetching the package's PyPI project page or GitHub README, where the usage example shows an API key literal next to the package name. Suppressed by filter_placeholders (YOUR_API_KEY, <api_key>, sk-example) and filter_docs (fenced code block plus a pip install line).
- Developer test suites and recorded HTTP fixtures for hasdata-airbnb-mcp that embed mock credentials. Suppressed by filter_test_fixture.
- A user's genuine HasData service key that happens to match a generic secret shape. HasData keys are not sk-/AKIA/ghp_ prefixed, so sel_cred should not match them; if a deployment issues keys in one of those formats this rule will report on every call from that deployment and sel_cred must be tightened.
- A legitimate integration that intentionally posts a callback_url to receive async scrape results. This is a supported pattern for some scraping APIs; if it is in use here, sel_exfil_param will report on normal traffic and should be dropped from the condition rather than the destination being allowlisted.
- Debug or error payloads that echo the agent's environment (os.environ dumps in a stack trace) attached to an outbound request. Genuinely worth reviewing, but it is operator error rather than package compromise.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://attack.mitre.org/techniques/T1567/
- https://attack.mitre.org/techniques/T1552/001/

---
Source: https://www.netzilo.com/threats/hasdata-airbnb-mcp-credential-relay