告诉 HN：Fiverr 将客户文件公开且可搜索
2 分•作者: morpheuskafka•4 个月前
Fiverr（零工/任务平台，Upwork 的竞争对手）使用名为 Cloudinary 的服务来处理消息传递中的 PDF/图像，包括工人向客户提交的工作产品。
除了 PDF 处理的增值功能外，Cloudinary 在这里实际上充当了 S3 的角色，直接向 Web 客户端提供资源。与 S3 一样，它支持签名/过期的 URL。然而，Fiverr 选择对敏感的客户-工人通信使用公共 URL，而不是签名 URL。
此外，他们似乎在某个地方提供公共 HTML，链接到这些文件。因此，数百个文件出现在 Google 搜索结果中，其中许多包含 PII（个人身份信息）。
示例查询：site:fiverr-res.cloudinary.com form 1040
事实上，Fiverr 积极购买 Google 广告，针对“form 1234 filing”等关键词，尽管他们知道这并不能充分保护最终的工作产品，导致准备者违反了 GLBA/FTC 安全规则。
负责任的披露说明——自向指定的漏洞电子邮件（security@fiverr.com）发出通知以来，已经过去了 40 天。安全团队没有回复。因此，由于这似乎不符合 CVE/CERT 处理的资格，因为它实际上不是代码漏洞，而且我不知道还有谁会关心它，所以将其公开。
查看原文
Fiverr (gig work/task platform, competitor to Upwork) uses a service called Cloudinary to process PDF/images in messaging, including work products from the worker to client.<p>Besides the PDF processing value add, Cloudinary effectively acts like S3 here, serving assets directly to the web client. Like S3, it has support for signed/expiring URLs. However, Fiverr opted to use public URLs, not signed ones, for sensitive client-worker communication.<p>Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII.<p>Example query: site:fiverr-res.cloudinary.com form 1040<p>In fact, Fiverr actively buys Google Ads for keywords like "form 1234 filing" despite knowing that it does not adequately secure the resulting work product, causing the preparer to violate the GLBA/FTC Safeguards Rule.<p>Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply. Therefore, this is being made public as it doesn't seem eligible for CVE/CERT processing as it is not really a code vulnerability, and I don't know anyone else who would care about it.