DEV-TOOLSApril 14, 20261 min read8 views

Tell HN: Fiverr left customer files public and searchable

Fiverr is exposing sensitive client-worker documents, including tax forms, to Google Search due to misconfigured public URLs. Despite a 40-day notice, the company has failed to respond or secure the data.

Fiverr (gig work/task platform, competitor to Upwork) uses a service called Cloudinary to process PDF/images in messaging, including work products from the worker to client.

Besides the PDF processing value add, Cloudinary effectively acts like S3 here, serving assets directly to the web client. Like S3, it has support for signed/expiring URLs. However, Fiverr opted to use public URLs, not signed ones, for sensitive client-worker communication.

Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII.

Example query: site:fiverr-res.cloudinary.com form 1040

In fact, Fiverr actively buys Google Ads for keywords like "form 1234 filing" despite knowing that it does not adequately secure the resulting work product, causing the preparer to violate the GLBA/FTC Safeguards Rule.

Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email ([email protected]). The security team did not reply. Therefore, this is being made public as it doesn't seem eligible for CVE/CERT processing as it is not really a code vulnerability, and I don't know anyone else who would care about it.

Source: Hacker News

More in this category

dev-tools

Linux kernel will support $ORIGIN, sort of

Farid Zakaria shares his journey of proposing a patch to the Linux kernel to support relocatable binaries in Nix, which evolved into a powerful eBPF-based solution for binfmt_misc.

dev-tools

Five US tech giants' hidden debts soar to $1.65T on opaque AI funding

A Nikkei study reveals that off-balance-sheet debts at five major US tech companies have surged eightfold to $1.65 trillion, driven by massive AI investments like data center leases and GPU contracts.

dev-tools

Running Doom on Our Custom CPU and Going Viral

Two developers successfully built a custom CPU from scratch at the logic gate level, deployed it on an FPGA, and optimized its memory architecture to run the classic game DOOM.

dev-tools

Incremental – A library for incremental computations

Incremental is a library designed for building complex computations that update efficiently when inputs change. Inspired by self-adjusting computation research, it is highly useful for large-scale calculations, GUI views, and data synchronization.

dev-tools

Flock Credibility Lost as It Repeatedly Lies to City Councils, Police, & Public

Flock Safety, a prominent provider of automatic license plate readers (ALPR), is facing a severe credibility crisis after being caught repeatedly misleading city councils, police departments, and the public about its surveillance capabilities and data practices.

dev-tools

Human mathematicians are being outcounterexampled

In just a few weeks, advanced AI models like ChatGPT Sol and Claude Fable have disproved long-standing mathematical conjectures by finding precise counterexamples and auto-formalizing them in Lean.