Tell HN: Fiverr left customer files public and searchable

209

mmorpheuskafka about 4 hours ago 30 comments

ZH version is available. Content is displayed in original English for accuracy.

Fiverr (gig work/task platform, competitor to Upwork) uses a service called Cloudinary to process PDF/images in messaging, including work products from the worker to client.

Besides the PDF processing value add, Cloudinary effectively acts like S3 here, serving assets directly to the web client. Like S3, it has support for signed/expiring URLs. However, Fiverr opted to use public URLs, not signed ones, for sensitive client-worker communication.

Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII.

Example query: site:fiverr-res.cloudinary.com form 1040

In fact, Fiverr actively buys Google Ads for keywords like "form 1234 filing" despite knowing that it does not adequately secure the resulting work product, causing the preparer to violate the GLBA/FTC Safeguards Rule.

Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply. Therefore, this is being made public as it doesn't seem eligible for CVE/CERT processing as it is not really a code vulnerability, and I don't know anyone else who would care about it.

⚡ Community Insights

Discussion Sentiment

23% Positive

Analyzed from 637 words in the discussion.

Discussion (30 Comments)Read Original on HackerNews

gregsadetsky•6 minutes ago

I wrote to security@fiverr.com and they just replied:

"You’re the second person to flag this issue to us

Please note that our records show no contact with Fiverr security regarding this matter ~40 days ago unlike the poster claims. We are currently working to resolve the situation"

HeliumHydride•16 minutes ago

It seems that someone sent a DMCA complaint months ago relating to this: https://lumendatabase.org/notices/53130362

applfanboysbgon•32 minutes ago

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

morpheuskafka•29 minutes ago

They may be part of it, but as a publicly traded company, there's got to be a at least a few people there with a fancy pedigree (not that that actually means they are good at their job or care). But if such a test existed, they presumably would have passed it.

They also have an ISO 27001 certificate (they try to claim a bunch of AWSs certs by proxy on their security page, which is ironic as they say AWS stores most of their data while apparently all uploads are on this).

qingcharles•about 1 hour ago

That's wild. Thousands of SSNs in there. Also a lot of Fiverr folks selling digital products and all their PDF courses are being returned for free in the search results.

mtmail•about 4 hours ago

You followed the correct reporting instructions.

https://www.fiverr.com/.well-known/security.txt only has "Contact: security@fiverr.com" and in their help pages they say "Fiverr operates a Bug Bounty program in collaboration with BugCrowd. If you discover a vulnerability, please reach out to security@fiverr.com to receive information about how to participate in our program."

wxw•about 3 hours ago

Wow, surprised this isn't blowing up more. Leaking form 1040s is egregious, let alone getting them indexed by Google...

janoelze•about 1 hour ago

really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.

mpeg•about 1 hour ago

lots of admin credentials too, which have probably never been changed

janoelze•42 minutes ago

admin passwords to dating sites, that's the stuff people get blackmailed with

qq66•18 minutes ago

How does someone's dating site password end up in Fiverr?

tfsh•33 minutes ago

Hopefully this can be patched soon.

Their robots file specifically has the code to disallow search engine crawling commented out - https://fiverr-res.cloudinary.com/robots.txt.

---

     See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file
     #
     # To ban all spiders from the entire site uncomment the next two lines:
     # User-Agent: \*
     # Disallow: /

johnmlussier•about 1 hour ago

Probably not in scope but maybe https://bugcrowd.com/engagements/cloudinary will care?

This is bad.

morpheuskafka•about 1 hour ago

They probably wouldn't act immediately as there's no way for them to enable signing without breaking their client's site. The only cleanup you could do without that would be having google pull that subdomain I guess?

(Fiverr itself uses Bugcrowd but is private, having to first email their SOC as I did.)

impish9208•about 1 hour ago

This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.

yieldcrv•15 minutes ago

I found someone's manuscript, at first I thought it would scandalous to find it ghost written, but it actually is just annotations and someone proof reading it, the annotations come up in the PDF

I found the author on Amazon and the book still hasn't been released

this is sad

sergiotapia•23 minutes ago

Link please :pray:

yapfrog•15 minutes ago

https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...

I will say that the title is the best part

onraglanroad•about 1 hour ago

I've read worse. Better than Dan Brown!

b00ty4breakfast•28 minutes ago

that bar is subterranean, haha

mraza007•about 3 hours ago

Woah that's brutal all the important information is wild in public

sergiotapia•31 minutes ago

This is really bad, just straight up people's income, SSN and worse just right there in the search results on Brave Search even.

yieldcrv•34 minutes ago

this is a bad leak, appreciate the attempts at disclosure before this

smashah•about 2 hours ago

They bought and.co and then dropped it. strange company

popalchemist•about 2 hours ago

Burn it to the ground.

BoredPositron•about 2 hours ago

Just by scrolling over it that's really rough.

iwontberude•about 2 hours ago

Loooool what a mess

walletdrainer•42 minutes ago

> Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII

This is not how Google works.

AndroTux•23 minutes ago

It kind of is, though. Google doesn't randomly try to visit every URL on the internet. It follows links. Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.