Hacker News Reader

Comment by jonesetc | Hacker News Reader

I added a client, got a shortlink, and checked as well. Then I removed the client and the link persisted for a few minutes (even after clearing cache). Now my link redirects to the error message like your example. Short period, but since there are so few options I would think this is indeed an issue that could be exploited.

View on HN

Exploited how? It's only used to send data in and it should be a pretty simple matter to not accept traffic from multiple machines for one API key. I accidentally used the same shortlink to install on two servers last night and saw a "there are multiple servers sending data, check your configuration" error (while the stats stayed correct).

I believe the fear here is that if you can guess URLs, and one of those URLs works and provides you with a script that contains an API key, you could use that API key to perform other, non-Longview-related API calls to Linode's management API.

That's a pretty decent fear. I don't know if there's any other controls on the API key that prevent it from being as vulnerable as this suggests...

According to Linode support, the API key provided is unique to longview and can't be used for anything else.

It's a different API key for every Longview machine. I set up 3 and the keys are different in each case (which is also why the short URL changes for each machine, the API key is part of the response and is different for each machine).

Yup it seems the link only persists for a few minutes. But given the knowledge that a lot of people are currently installing longview and that it takes only less than a minute to iterate though all the possible combinations of the 4 character token, it could still be exploitable. They should definitely increase the token length to a safe number.

Reply on news.ycombinator.com