4 ms·

I added a client, got a shortlink, and checked as well. Then I removed the client and the link persisted for a few minutes (even after clearing cache). Now my l

I added a client, got a shortlink, and checked as well. Then I removed the client and the link persisted for a few minutes (even after clearing cache). Now my link redirects to the error message like your example. Short period, but since there are so few options I would think this is indeed an issue that could be exploited.

nivla 13y ago
Yup it seems the link only persists for a few minutes. But given the knowledge that a lot of people are currently installing longview and that it takes only less than a minute to iterate though all the possible combinations of the 4 character token, it could still be exploitable. They should definitely increase the token length to a safe number.
jonknee 13y ago
Exploited how? It's only used to send data in and it should be a pretty simple matter to not accept traffic from multiple machines for one API key. I accidentally used the same shortlink to install on two servers last night and saw a "there are multiple servers sending data, check your configuration" error (while the stats stayed correct).
- mfenniak 13y ago
  I believe the fear here is that if you can guess URLs, and one of those URLs works and provides you with a script that contains an API key, you could use that API key to perform other, non-Longview-related API calls to Linode's management API. That's a pretty decent fear. I don't know if there's any other controls on the API key that prevent it from being as vulnerable as this suggests...
  - TheSwordsman 13y ago
    According to Linode support, the API key provided is unique to longview and can't be used for anything else.
  - jonknee 13y ago
    It's a different API key for every Longview machine. I set up 3 and the keys are different in each case (which is also why the short URL changes for each machine, the API key is part of the response and is different for each machine).

nivla 13y ago

Yup it seems the link only persists for a few minutes. But given the knowledge that a lot of people are currently installing longview and that it takes only less than a minute to iterate though all the possible combinations of the 4 character token, it could still be exploitable. They should definitely increase the token length to a safe number.

jonknee 13y ago

Exploited how? It's only used to send data in and it should be a pretty simple matter to not accept traffic from multiple machines for one API key. I accidentally used the same shortlink to install on two servers last night and saw a "there are multiple servers sending data, check your configuration" error (while the stats stayed correct).

mfenniak 13y ago
I believe the fear here is that if you can guess URLs, and one of those URLs works and provides you with a script that contains an API key, you could use that API key to perform other, non-Longview-related API calls to Linode's management API. That's a pretty decent fear. I don't know if there's any other controls on the API key that prevent it from being as vulnerable as this suggests...
- TheSwordsman 13y ago
  According to Linode support, the API key provided is unique to longview and can't be used for anything else.
- jonknee 13y ago
  It's a different API key for every Longview machine. I set up 3 and the keys are different in each case (which is also why the short URL changes for each machine, the API key is part of the response and is different for each machine).