Security: Using --share produce URLs which are way too easy to guess

Question

Security: Using --share produce URLs which are way too easy to guess

leszekhanusz opened this issue 2 years ago · comments

Describe the bug

The URLs currently produced when using the share option are in the form https://12345.gradio.app

The numbers at the start are way too easy to guess, a malicious actor can easily try every combination of numbers to find a specific application and could allow remote code execution depending on the application.

Possible solution: instead of using only 5 numbers with low entropy (10^5 = 100000), use something like 15 characters in the range [0-9][a-z][A-Z] (base 62) with (26+26+10)^15 = 7,689097049×10²⁶ possibilities which will generate URLs looking like this: https://vteiTSJw4V0GOL5.gradio.app

Note: not reporting this issue as a security issue as this is already a public issue

Is there an existing issue for this?

I have searched the existing issues

Reproduction

N/A

Screenshot

No response

Logs

N/A

System Info

N/A

Severity

serious, but I can work around it

Abubakar Abid · Answer 1 · Sun Oct 16 2022 20:23:29 GMT+0800 (China Standard Time)

Thanks for reporting the issue @leszekhanusz, agreed about the seriousness of the issue, let us see if we can quickly fix it.

Abubakar Abid · Answer 2 · Mon Oct 17 2022 12:51:17 GMT+0800 (China Standard Time)

Hi @leszekhanusz we just pushed a change to how our links are generated so this issue should now be fixed across all versions of Gradio. I would appreciate if you can try it out and let us know if it works for you

Hanusz Leszek · Answer 3 · Mon Oct 17 2022 15:22:44 GMT+0800 (China Standard Time)

Thanks for the quick reaction! I don't have access to my pc today, could someone else confirm it's fixed?

amrrs · Answer 4 · Tue Oct 18 2022 13:13:51 GMT+0800 (China Standard Time)

@abidlabs It's working fine

Abubakar Abid · Answer 5 · Tue Oct 18 2022 13:18:37 GMT+0800 (China Standard Time)

Great! I’ll go ahead and close the issue then

float-trip · Answer 6 · Thu Oct 27 2022 11:58:49 GMT+0800 (China Standard Time)

@abidlabs One of my URLs was just recycled within a couple hours of shutting the down the app. Given the large number of bits in the subdomain, it seems these new URLs aren't random, but maybe something like a hash of the original ID. In any case, it looks like it's possible to spin up demos and collect URLs to guess in the future

Abubakar Abid · Answer 7 · Thu Oct 27 2022 13:30:56 GMT+0800 (China Standard Time)

Thanks for the heads up @float-trip. Share URLs can still be recycled in theory, but this PR: #2509 should completely fix that. We'll aiming to release next week!