YHK - yet another hacker news clone

156 points morpheuskafka 3 hours ago 15 comments

Fiverr (gig work/task platform, competitor to Upwork) uses a service called Cloudinary to process PDF/images in messaging, including work products from the worker to client.

Besides the PDF processing value add, Cloudinary effectively acts like S3 here, serving assets directly to the web client. Like S3, it has support for signed/expiring URLs. However, Fiverr opted to use public URLs, not signed ones, for sensitive client-worker communication.

Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII.

Example query: site:fiverr-res.cloudinary.com form 1040

In fact, Fiverr actively buys Google Ads for keywords like "form 1234 filing" despite knowing that it does not adequately secure the resulting work product, causing the preparer to violate the GLBA/FTC Safeguards Rule.

Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply. Therefore, this is being made public as it doesn't seem eligible for CVE/CERT processing as it is not really a code vulnerability, and I don't know anyone else who would care about it.

mtmail 2 hours ago | parent

You followed the correct reporting instructions.

https://www.fiverr.com/.well-known/security.txt only has "Contact: security@fiverr.com" and in their help pages they say "Fiverr operates a Bug Bounty program in collaboration with BugCrowd. If you discover a vulnerability, please reach out to security@fiverr.com to receive information about how to participate in our program."

wxw 2 hours ago | parent

Wow, surprised this isn't blowing up more. Leaking form 1040s is egregious, let alone getting them indexed by Google...

mraza007 2 hours ago | parent

Woah that's brutal all the important information is wild in public

BoredPositron 1 hour ago | parent

Just by scrolling over it that's really rough.

popalchemist 1 hour ago | parent

Burn it to the ground.

smashah 58 minutes ago | parent

They bought and.co and then dropped it. strange company

iwontberude 54 minutes ago | parent

Loooool what a mess

impish9208 43 minutes ago | parent

This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.

onraglanroad 35 minutes ago | parent

I've read worse. Better than Dan Brown!

johnmlussier 29 minutes ago | parent

Probably not in scope but maybe https://bugcrowd.com/engagements/cloudinary will care?

This is bad.

morpheuskafka 21 minutes ago | parent

They probably wouldn't act immediately as there's no way for them to enable signing without breaking their client's site. The only cleanup you could do without that would be having google pull that subdomain I guess?

(Fiverr itself uses Bugcrowd but is private, having to first email their SOC as I did.)

janoelze 11 minutes ago | parent

really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.

mpeg 9 minutes ago | parent

lots of admin credentials too, which have probably never been changed

qingcharles 6 minutes ago | parent

That's wild. Thousands of SSNs in there. Also a lot of Fiverr folks selling digital products and all their PDF courses are being returned for free in the search results.