T09 · Insecure Skill Coding Practices
Error
- Location
cli-reference.md:466- Finding
Web UI Exposes Indexed Local Documents on All Network Interfaces by Default
- Content
View full analysis
Vulnerability Details
File Location:
cli-reference.md:466-479
Vulnerability Type: Unsafe default network binding without documented access controls
Risk Level: HighVulnerable Code Snippet
markdown ## Web UI ### gno serve Start web UI for browsing, searching, and querying documents. ```bash gno serve [options]Option Default Description -p, --port3000 Port to serve on --host0.0.0.0 Host to bind Features: Dashboard, search, browse collections, document viewer, AI Q&A with citations.
text ### Technical Analysis The documented default host is `0.0.0.0`, which causes the web server to listen on every available network interface rather than only the loopback interface. The application provides search, collection browsing, document viewing, and AI-assisted querying over indexed local documents. No authentication, authorization, TLS requirement, origin restriction, or warning about remote exposure is documented. Consequently, running the command with its defaults may expose indexed private documents to any system that can reach TCP port 3000. The affected implementation is not included in the audited package, so the presence or absence of undocumented runtime protections could not be verified. ### Attack Path 1. A user adds a directory containing private or sensitive documents to a GNO collection. 2. The user indexes those documents with `gno index`. 3. The user starts the web interface using `gno serve` without overriding the host. 4. The service binds to `0.0.0.0:3000`, making it reachable through all host network interfaces. 5. A network-adjacent attacker identifies the open port and connects to the web interface. 6. If no runtime access control exists, the attacker searches, browses, views, or queries indexed documents through the exposed interface. ### Impact Assessment A successful attack could disclose any content access ...[truncated 537 chars]- Remediation
View remediation
Remediation Suggestions
- Change the default bind address from
0.0.0.0to127.0.0.1and, where applicable,::1. - Require users to explicitly opt into non-loopback binding, such as with
--host 0.0.0.0. - Display a prominent warning and require confirmation whenever the server binds to a non-loopback address.
- Require strong authentication and authorization for remote access, with access scoped by collection and operation.
- Protect non-loopback deployments with TLS, secure session handling, request throttling, and appropriate origin controls.
- Document firewall requirements and recommend restricting port 3000 to explicitly trusted clients.
- Avoid exposing document viewing or full-content retrieval to anonymous users.
- Add automated tests verifying that the default listener is loopback-only and that remote deployments reject unauthenticated requests.
- Change the default bind address from