9 ms·

Tell HN: Fiverr left customer files public and searchable

831 points by morpheuskafka 6mo ago

Fiverr (gig work/task platform, competitor to Upwork) uses a service called Cloudinary to process PDF/images in messaging, including work products from the worker to client. Besides the PDF processing value add, Cloudinary effectively acts like S3 here, serving assets directly to the web client. Like S3, it has support for signed/expiring URLs. However, Fiverr opted to use public URLs, not signed ones, for sensitive client-worker communication. Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII. Example query: site:fiverr-res.cloudinary.com form 1040 In fact, Fiverr actively buys Google Ads for keywords like "form 1234 filing" despite knowing that it does not adequately secure the resulting work product, causing the preparer to violate the GLBA/FTC Safeguards Rule. Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply. Therefore, this is being made public as it doesn't seem eligible for CVE/CERT processing as it is not really a code vulnerability, and I don't know anyone else who would care about it.

rapfaria 6mo ago
How big of a client is Fiverr? Surely Cloudinary would have alerts for an enterprise client leaking stuff? Just insane
- cleaning 6mo ago
  Literally the first featured client on their landing page. Amateurs all the way down.
mtmail 6mo ago
You followed the correct reporting instructions. https://www.fiverr.com/.well-known/security.txt https://www.fiverr.com/.well-known/security.txt only has "Contact: security@fiverr.com" and in their help pages they say "Fiverr operates a Bug Bounty program in collaboration with BugCrowd. If you discover a vulnerability, please reach out to security@fiverr.com to receive information about how to participate in our program."
wxw 6mo ago
Wow, surprised this isn't blowing up more. Leaking form 1040s is egregious, let alone getting them indexed by Google...
- snayan 6mo ago
  I want to believe that it's people keeping mum until it's fixed so that the leaked PII isn't spread more widely, minimize the risk of bad actors scraping it all. Once the leak is plugged, I would hope that Fiverr gets absolutely raked over the coals, this is egregious.
  - sizzle 6mo ago
    I wouldn’t be surprised if someone wrote a script to pull all the sensitive PII and it’s already on the dark net hacking forums for identity thieves. Freeze your credit at all bureaus if you ever used this site.
    - weird-eye-issue 6mo ago
      > Freeze your credit at all bureaus if you ever used this site. People should always have their credit frozen no matter what. It's free and only takes a few minutes to unfreeze when you need to apply for credit Yes it's a little bit inconvenient but so is suddenly having a car, insurance, and several iPhones in your name when somebody steals your identity...
      - oefrha 6mo ago
        My Experian score once took a substantial hit, dropping from ~800 to ~700 or something like that. Didn’t change elsewhere. I applied for the report and realized a quite significant debt appeared on my report, and it wasn’t even in my name! It was under someone else’s name that bore zero similarity to mine, or anyone in my family. Reported to Experian and it got fixed after a week or two. Zero explanation for how it happened. These credit reporting agencies are a joke.
deleted 6mo ago
[deleted]
mraza007 6mo ago
Woah that's brutal all the important information is wild in public
BoredPositron 6mo ago
Just by scrolling over it that's really rough.
popalchemist 6mo ago
Burn it to the ground.
smashah 6mo ago
They bought and.co and then dropped it. strange company
iwontberude 6mo ago
Loooool what a mess
- xtracto 6mo ago
  I just looked at the google search results... Holly cow... it is bad bad bad
impish9208 6mo ago
This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.
- onraglanroad 6mo ago
  I've read worse. Better than Dan Brown!
  - b00ty4breakfast 6mo ago
    that bar is subterranean, haha
- sergiotapia 6mo ago
  Link please :pray:
  - yapfrog 6mo ago
    [flagged]
    - Barbing 6mo ago
      Do you mind if I share your private documents if I come across them?
  - IIsi50MHz 6mo ago
    Now returns Null for me, but looks like it was https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments/delivery/asset/e963e7803fa940c35ae182ee45af5908-1662827616/HNA%20full%20Source%20file.pdf https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/... Also, a version of this appears to be currently sold on Amazon for $15 USD.
    - 3abiton 6mo ago
johnmlussier 6mo ago
Probably not in scope but maybe https://bugcrowd.com/engagements/cloudinary https://bugcrowd.com/engagements/cloudinary will care? This is bad.
- morpheuskafka 6mo ago
  They probably wouldn't act immediately as there's no way for them to enable signing without breaking their client's site. The only cleanup you could do without that would be having google pull that subdomain I guess? (Fiverr itself uses Bugcrowd but is private, having to first email their SOC as I did.)
deleted 6mo ago
[deleted]
janoelze 6mo ago
really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.
- mpeg 6mo ago
  lots of admin credentials too, which have probably never been changed
  - janoelze 6mo ago
    admin passwords to dating sites, that's the stuff people get blackmailed with
    - qq66 6mo ago
      How does someone's dating site password end up in Fiverr?
      - janoelze 6mo ago
        it's worse than you think – it's an admin password to the ~whole site~
        xtracto 6mo ago
        Oh my. I feel for the tech team at fiverr. I'm sure it's nasty in there. Sending virtual hugs.
        bombcar 6mo ago
        They have a dating site password! They can get real hugs.
        ndsipa_pomu 6mo ago
        Meanwhile, I hope they get sent to prison for being so cavalier with other people's PII.
qingcharles 6mo ago
That's wild. Thousands of SSNs in there. Also a lot of Fiverr folks selling digital products and all their PDF courses are being returned for free in the search results.
walletdrainer 6mo ago
[flagged]
- AndroTux 6mo ago
  It kind of is, though. Google doesn't randomly try to visit every URL on the internet. It follows links. Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.
  - xtracto 6mo ago
    Exactly , that's whyb"non public" github gists work. They are public, but not indexed anywhere "by default "
  - Barbing 6mo ago
    Good thing, otherwise they would have exposed countless photos via Google Photos. Today, a photo file might be hosted at: photos.fife.usercontent.google.com/pw/[snip]=w[####]-h[####]-s-no-gm?authuser=0 But it used to be a little closer to: ...[google_site].com/[superLongAlphanumeric].jpg And no auth required, URL only!
  - walletdrainer 6mo ago
    > Therefore, for these files to be indexed by Google, they need to be linked to from somewhere. So? That’s indeed how Google works. Google does not work how OP describes it. I’ve investigated similar incidents in the past on other platforms, it was always user error causing links to be public.
    - AndroTux 6mo ago
      The only thing that's user error here is the developers of Fiverr exposing files without proper session authentication.
      - walletdrainer 6mo ago
        That’s very often a deliberate design decision. It’s bizarre UX if you link a file to someone and the link doesn’t work.
yieldcrv 6mo ago
this is a bad leak, appreciate the attempts at disclosure before this
deleted 6mo ago
[deleted]
applfanboysbgon 6mo ago
Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.
- morpheuskafka 6mo ago
  They may be part of it, but as a publicly traded company, there's got to be a at least a few people there with a fancy pedigree (not that that actually means they are good at their job or care). But if such a test existed, they presumably would have passed it. They also have an ISO 27001 certificate (they try to claim a bunch of AWSs certs by proxy on their security page, which is ironic as they say AWS stores most of their data while apparently all uploads are on this).
  - trollbridge 6mo ago
    A while ago I had a customer come to me who had a simple Shopify site and fell for a phishing type of attack where someone simply had an email like "shopify_security at gmail" and kept telling her she needed to apply all kinds of changes. They laundered the payments through Fiverr. Then they would install WordPress plugins to make the site worse and claim even more "work" was needed. I documented the entire thing, including my own credentials, and sent it off to Fiverr. Fiverr's response was everything was fine and there was nothing they could do about it, even though it was obvious fraud. Google never did anything about it either, nor did Shopify. Given how they handled such a minor situation like that... I guess it shouldn't be surprising they're just asleep at the switch for a major one like this.
  - bluefirebrand 6mo ago
    > But if such a test existed, they presumably would have passed it Sure, and now they could have their credentials revoked, potential be legally liable, and never find work in this field again which would prevent them from cocking up another company this way
sergiotapia 6mo ago
This is really bad, just straight up people's income, SSN and worse just right there in the search results on Brave Search even.
HeliumHydride 6mo ago
It seems that someone sent a DMCA complaint months ago relating to this: https://lumendatabase.org/notices/53130362 https://lumendatabase.org/notices/53130362
- avian 6mo ago
  > Recipient: Google LLC This complaint was sent to Google, probably because the cloudinary.com URL appeared in their search results. It's doubtful anyone at Fiverr was made aware of this - unless Google typically forwards these complaints to the actual host of the offending URL. Even then, it would go to Cloudinary who would in turn need to notify their client. Many hops with plenty of "someone else's problem" barriers for the message to overcome.
gregsadetsky 6mo ago
I wrote to security@fiverr.com and they just replied: "You’re the second person to flag this issue to us Please note that our records show no contact with Fiverr security regarding this matter ~40 days ago unlike the poster claims. We are currently working to resolve the situation"
- Loughla 6mo ago
  So who has more incentive to lie, fiverr or OP?
  - applfanboysbgon 6mo ago
    Is this even a question? Obviously, the company that has publicly posted people's tax forms on the internet is very trustworthy and we should eagerly believe everything they say. I don't think it even comes down to "lying". It's possible that they genuinely believe they didn't receive contact, but given that they are verifiably completely and totally incompetent and have no right to be employed in their current role, they've earned exactly zero benefit of doubt.
    - janoelze 6mo ago
      (weird to share any details about this incident to uninvolved parties via email anyway)
    - morpheuskafka 6mo ago
      @janoelze -- that was my thought too, though less so that they wouldn't share a claim of not being notified at all with a third party, but more that those kind of things need to go through legal/comms/etc not whoever runs the security mailbox. if the person running the email box is not the CISO, surely they at least need the CISOs approval to say something beyond a thank you or followup questions? (and if they are the CISO, then they have bigger things to worry about then replying...)
    - zelphirkalt 6mo ago
      Exactly, it doesn't have to be about them lying. It could simply be, that they let go or lost one of their engineers and that person knew why to do what and the next one didn't, accidentally exposing stuff.
psygn89 6mo ago
I guess they used Fiverr for security
janoelze 6mo ago
it's been 5 hours. even manual action to take down the most sensitive files should have completed about 3 hours ago at most. what is happening.
- tag2103 6mo ago
  Nothing- they are just hoping this will blow over.
  - Barbing 6mo ago
    Do I have to start emailing the people in the leaked documents with screenshots?
    - oefrha 6mo ago
      Leaving a paper trail of you having accessed unauthorized private info is a bad idea, some crazy lawyer could decide to include you in a suit. Just not worth the hassle. Email a tip line about the general situation.
      - Barbing 6mo ago
        Good call!
      - Ekaros 6mo ago
        Not to forget some eager prosecutors. They can still try to prosecute for accessing material even if they end up losing. Lot of hassle there.
      - ndsipa_pomu 6mo ago
        How is it unauthorised if it's freely available via a search without having to bypass any login? It'd be like putting up an advert and then trying to sue anyone who sees it.
        oefrha 6mo ago
pesus 6mo ago
Wow, the other comments weren't exaggerating. This is really bad. If my tax returns or other data were part of this, I might consider legal action. I wonder if somewhere like Wired/Ars Technica/404media might pick this up?
- Barbing 6mo ago
  Thanks, tip lines were a good idea
- 2Gkashmiri 6mo ago
  https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments/delivery/asset/22548447ff6a0cb8b23505f4c935a0b3-1599833140/Terrasafe https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/... This is too funny
  - TkTech 6mo ago
    Personally, this is the funniest one to me. It turns out Fiverr uses cloudinary for their internal documents as well. (Note: this one is not confidential and is public information) https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments-dev/generic_asset/asset/e43a09ebf5ec0954b2ff2b83f67b1964-1673810461528/FIVERR%20INTERNATIONAL%20LTD.%2027001.pdf https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...
    - 2Gkashmiri 6mo ago
      I saw that too. Ddg didn't give me a lot of results. Beyond a few dozen
    - dewey 6mo ago
      Shows you how much these certifications are worth in reality.
      - bblb 6mo ago
        Absolutely worthless pieces of paper. We had the ISO 270001 and the physical security "walk tour" or whatever it's called; I could've outsourced that to a bunch of preschoolers walking around the offices and data center rooms and would've gotten the same result. The only _actually_ working way to protect your org is to continuously attack your own systems and see what part of it breaks or leaks data.
cleaning 6mo ago
Wow this is really really bad. Insane this hasn't been fixed yet, media outlets are going to have a fun time with this story
fortran77 6mo ago
[flagged]
101008 6mo ago
There are health stuff too... and they are not even paying attention to this matter https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments/delivery/asset/6185f64c813689cc34ea5b9770223bc3-1667595208/WhatsApp%20Image%202022-11-03%20at%204.56.16%20PM.pdf https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...
- nikanj 6mo ago
  Someone got an antivaxx certificate from Fiverr, not sure if that counts as delicate health information
ebbi 6mo ago
I've been boycotting Fiverr, so I'm glad I'm not caught up in this. And judging by their response to this issue, I'm glad I've been boycotting it.
- morpheuskafka 6mo ago
  I've never tried their platform, but I once made an account on Upwork and it is absolutely ridiculous. I'm sure they are very similar. People are asking for AWS help and giving root passwords to random contractors. A lot of people asking for CPA letters for loans and help with tax problems but their budget is under $100. And outright fraud posts are often seen asking for people to open bank accounts or otherwise bypass KYC. Upwork now has an AI feature to help write job posts, so all the time you can see things like "If you want to attract freelancers like X, I can change it." So now the job posts are all written like corporate ones talking about "highly experienced in X" but pay almost nothing. Half the time the clients don't even know the words in their own post. And it charges every time someone applies to a job and then more to boost to top of list because every job gets 30+ applications supposedly.
  - mock-possum 6mo ago
    Upwork struck me as a straight up scam or pyramid scheme or something. Total turnoff.
  - TZubiri 6mo ago
    I think the AI thing also transforms functional requirements into technical requirements, often incorrectly. "I want to build a website" gets converted into: "I'm looking for someone with 5+ years of 'hands on' React experience"
evmaki 6mo ago
Extremely bad stuff here. Can't believe it's been 7 hours now and you can still pull up people's complete prepared tax returns right from a Google search. This should be a business-ending breach of trust and good practices, but I worry there's probably a lack of regulatory might or will to make anything happen.
- TkTech 6mo ago
  It's very unfortunate but a significant amount of the most damaging stuff in this is from the underprivileged and those with minimal means who were trying to find help they could afford. Non-profits trying to get website help, confidential reports for charities trying to get translations, children seeking therapy (fiverr has a therapy category!?) for some truly dark stuff. Utterly inexcusable that this is still up after so many hours.
- mellosouls 6mo ago
  Technically, 40 days and 7 hours!
  - ChrisMarshallNY 6mo ago
    ...and forty nights...
    - kkarpkkarp 6mo ago
      ...since you leaked my data away
- deepserket 6mo ago
  It looks like they (cloudinary?) blocked the content. Each result from the query site:fiverr-res.cloudinary.com form 1040 returns 404
  - abustamam 6mo ago
    Yikes! It should not require the service provider to block PII, but at least someone plugged the leak.
Jbird2k 6mo ago
Bruh this stuff is still public
Barbing 6mo ago
@dang example query feels incredibly doxxy, and feels bad form to link directly to full copies of people's [stuff] and [personal info] as seen on this page :/ I know this is all Fiverr's fault for allegedly missing the responsible disclosure but now is this the ideal way for us to discuss, with these particular examples? I ask not to spare Fiverr, but I would be so mad if I were first for the result in OP or my personal info linked directly...
- epaga 6mo ago
  @dang I agree that some/many of these links should not be posted here.
  - ratg13 6mo ago
    If this gets swept under the rug, it doesn't seem like they are going to do anything about it, and it will mean that only the bad people are going to be able to find this stuff.. who knows for how long.
- BoredPositron 6mo ago
  @dang doesn't work write an email if you mean your comment in a non performative way.
  - epaga 6mo ago
    Oh? I've seen him respond to that many times in the past...assumed he had some hook for those.
    - rkomorn 6mo ago
      Correlation vs causation?
      - epaga 6mo ago
        Well, maybe.
figassis 6mo ago
From what I’ve seen, this always ends in some small fine/settlement and “no admission of guilt”. This type of protection is the source of these mishaps.
gagagagaga 6mo ago
[dead]
npilk 6mo ago
Remember, if you use Google to access any of this “private” information, you’re a hacker and the state of Missouri might try to arrest you! https://missouriindependent.com/2021/10/14/missouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website/ https://missouriindependent.com/2021/10/14/missouri-governor...
csomar 6mo ago
Given the existing DMCA requests and the fact that Google has become way less aggressive about indexing this stuff, it's clear this has been going on for a while. My guess is they've gutted enough of their internal processes that they literally can't restrict access to these files without breaking their own platform. You really can't make this shit up: https://www.linkedin.com/feed/update/urn:li:activity:7445526281590497280/ https://www.linkedin.com/feed/update/urn:li:activity:7445526... The real question is: will Fiverr be the first company to truly crash and burn from an "AI-first" approach? Go LLM, go mayhem!
- AndroTux 6mo ago
  > will Fiverr be the first company to truly crash and burn from an "AI-first" approach? No. Nobody will care.
gostsamo 6mo ago
have you contacted the ftc if their regulation is being violated?
fudged71 6mo ago
It's been 10 hours and all the links in this comment section still work...
- csomar 6mo ago
  If you use Google AI mode, it'll be happy to find you any kind of PII information.
ecommerce_app 6mo ago
[dead]
TZubiri 6mo ago
I don't get why disclosing is considered acceptable, it seems like racketeering to me, "pay up or else I'll make this hypothetical issue an actual issue for you" When I reported an issue and gotten no response, I sat on it for 6 years, reported it again and they took the whole site down without reaching out to me, never quite got it, but if people are doing this, it makes sense not to acknowledge any report and just play deaf.
- nkrisc 6mo ago
  What’s hypothetical? All this is and has been publicly accessible. Have bad actors already found it? Who knows? So if Fiverr isn’t going to fix it then the next best thing is to warn people.
- morpheuskafka 6mo ago
  Huh? I didn't ask for any money here or in the original email. (not that I couldn't use some, as I only have $1000 and four heavy suitcases right now, but anyway...) I did include "bug bounty" in the email subject since they claimed to have a private program. Other than that, no mention of any kind of compensation. It probably doesn't even have any kind of resume value since it's not an actual code flaw/CVE, just an "unlocked door."
epaga 6mo ago
I tried posting a warning to /r/fiverr but the admins removed the post. And the files are STILL public...how in the world is "sitting it out" their course of action? Edit: I'm beginning to wonder if they might be locked out of their own site at this point. How hard could it be to just shut down the asset server until they get it sorted?
- morpheuskafka 6mo ago
  The ironic thing is, since they clearly don't have much code review, they could have actually patched the site in this time! Turn on signatures and throw in a couple backend lines to generate one wherever the URLs appear. Even if you have to go back and redo it tomorrow for robust security or performance, it would be an improvement over this. I'm not taking sides either way, but if you are of the all in on AI perspective as they are, shouldn't this be the ideal use case? It absolutely could have handled adding URL signing.
- elevatortrim 6mo ago
  If the assets are public and not associated to my account, how could they ever restore access if they made them inaccessible?
viaredux 6mo ago
I am a freelancer on Fiverr, this is VERY concerning. The amount of PII that I have sent over Fiverr, after sending NDA's is potentially all out in the public. I hope there will be accountability for this. IMO Fiverr has had terrible management for years! They simply do not care about their freelancers (and apparently also not about their customers).
- tdeck 6mo ago
  Amazing that a company whose whole brand is based on hiring people for $5 turns out to not respect the workers who created value on their platform.
  - viaredux 6mo ago
    I get your criticism, however, there was a lot of talent working on the platform for many years. I was averaging 150 USD per project, significantly more than 5 USD. Last year Fiverr started to push AI to the detriments of their freelancers, as well as a new "success score" metric, but never specifying how these metrics are calculated, making it very hard for freelancers to do something about it. This caused many accounts to "lose value" and thus rank lower on searches, causing a drop in income. I've reported this on the Fiverr Freelancer Forums, let's see how long my post stays up...
    - 21asdffdsa12 6mo ago
      There were also a ton of ArtIsts of the "Take the job, generate it with AI, throw the slop" rip and run kind of artistry.
      - tdeck 6mo ago
        Even before AI I remember reading that many of the "custom designed" logos on Fiverr were just ripoffs of existing trademarks.
        aetherspawn 6mo ago
pcblues 6mo ago
In spite of how the pollies sell it, regulation is the friend of anyone earning less than one million dollars per year. Regulation would fix this. Get on it.
- pcblues 6mo ago
  Sorry, didn't make it clear. If a company does not publicly respond to a privately made security breach allegation, they are in breach of their responsibility to maintain business. If the breach is rubbish, the alleger looks bad. The best to you.
mark124mj 6mo ago
[dead]
unkl_ 6mo ago
Looks like the cloudinary links are returning 404 now
nslsm 6mo ago
I don't really see what the issue is here? Someone with access to the URL (either the freelancer or the client) leaked it to Google, Google crawled it. How is this Fiverr's fault? I mean, okay, they could sign URLs, but it's not like they left a folder with directory listing on. Someone with access to the URLs, not them, willingly made the URLs public.
- aricooperdavis 6mo ago
  Users should have to be authenticated to access the resource, not just rely on the URL being a secret.
Nekorosu 6mo ago
I was scammed on Fiverr myself, so I may be biased, but this feels consistent with the platform incentives I saw firsthand. The dispute process did not seem designed to deal well with coordinated abuse, and weak controls around sensitive files would point to the same broader issue: user safety and data handling do not appear to be high priorities.
gta6news 6mo ago
[dead]
yellow_lead 6mo ago
The files are deleted now, that was fun while it lasted!
morpheuskafka 6mo ago
Files are now returning 404s as of right now, 0900 UTC 4/15. Would be interesting if someone with an account can check if they are visible to intended users or not, and if so, if their mitigation is robust (signed URLs?).
- viaredux 6mo ago
  I have an account and I can confirm that the URL's of shared files are still publicly accessible. Google is giving 404's indeed.
  - morpheuskafka 6mo ago
    Interesting. Did the URL scheme change with any expiry or signature params (like S3s X-Amz-Expires)?
viaredux 6mo ago
I tried to alert other freelancers on Fiver Forums about htis, but my post got deleted on for 'violating community rules'. I don't see how it did violate the rules, suspicious to say the least.
mellosouls 6mo ago
Now being reported more widely, linked back to OP, eg: https://cyberinsider.com/fiverr-exposes-sensitive-data-via-public-urls-indexed-by-google/ https://cyberinsider.com/fiverr-exposes-sensitive-data-via-p... https://cybernews.com/security/fiverr-leak-exposes-user-ids-contracts-data/ https://cybernews.com/security/fiverr-leak-exposes-user-ids-...
mellosouls 6mo ago
For anybody who missed OPs bit at the end: Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply.
dbg31415 6mo ago
Fiverr probably hired someone from Fiverr to do the web build security.
everdrive 6mo ago
Yet another in the innumerate examples of privacy statements being completely meaningless. I do think it is important to call this out when it happens, but I'm hardly surprised.
vswaroop04 6mo ago
Obvious! They dont care about freelancers
agent-kay 6mo ago
[flagged]
hoofhearted 6mo ago
Still publicly available. Just forwarded this post to a few members of Congress.
viaredux 6mo ago
Update: Fiverr denies allegations of a cybersecurity incident on X. “To be clear, this is not a cyber incident. Fiverr does not proactively expose users’ private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer’s consent before it can be uploaded. As always, any request to remove content is handled promptly by our team.”
- xtrial972 6mo ago
  this is because you copied the link with the token, token is generated for your logged in user. strip the token and it wouldn't work. other users does not have your token.
  - viaredux 6mo ago
    That's true, I just checked. I will edit my post, thanks!
  - ChrisMarshallNY 6mo ago
    You send the bearer token as a GET argument? I’m sure there’s a good reason for that. I do it, in a server that I publish for general use, but won’t do it, for the server that I control, as I make sure that it reads headers. Some PHP servers ignore auth headers (and, I suspect, other APIs), so you need to set general-purpose frameworks and servers to use GET arguments, but that’s a security issue, for exactly the reason you state. Too easy to leak logins. If you use headers, then copy and pasting URLs won’t leak logins. In any case, the token should be timed, but that’s a fairly weak precaution.
eudamoniac 6mo ago
The stock hasn't moved. Puts?
deepserket 6mo ago
Answer from Fiverr: "To be clear, this is not a cyber incident. Fiverr does not proactively expose users' private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer's consent before it can be uploaded. As always, any request to remove content is handled promptly by our team." https://x.com/fiverr/status/2044389801495773339?s=20 https://x.com/fiverr/status/2044389801495773339?s=20
- viaredux 6mo ago
  I also commented this, but I have to say their statement is false. The links to all the delivered projects are publicly accessible. I went over my orders and I could open every single one from another device, not logged in.
  - xtrial972 6mo ago
    this is because copied the link with the token, token is generated for your logged in user. strip the token and it wouldn't work
preetigagarwal 6mo ago
[dead]
MyUltiDev 6mo ago
The Cloudinary fix that nobody in this thread is naming is actually two lines. Upload the asset with type set to authenticated instead of the default upload type, and generate a signed URL server side with sign_url true whenever alogged in user requests it. Once the asset is authenticated the public URL stops resolving entirely, so even the Google indexed copies go cold. The reason Fiverr cannot just turn this on now is that they already have years of stored messages where every reference is the default public delivery type, and switching the existing media library from public to authenticated breaks every existing URL across the whole platform. That is the architectural brittleness someone upthread was pointing at, and it is also why the only realistic path forward for them is rotating new uploads to authenticated and accepting that the historical exposure is permanent. What would actually catch this category of mistake earlier, an SDK default that refused to upload anything as public unless you opt in?
cheesecaxe666 6mo ago
[dead]
weird-eye-issue 6mo ago
This is still live???
laurakalninaaa 6mo ago
[dead]
maryjeiel 6mo ago
[flagged]
matrixgard 6mo ago
[dead]
thomasquarre 6mo ago
[dead]
ttrinity 6mo ago
Non-dev here, I think the small business I work for was involved in this data leak. I started a project with a developer on Fivver - he is very well rated and has an extensive portfolio, so I felt comfortable working with him. Last week, he gave me a requirement document that I filled out with our info (stripe integration API keys, domain access, etc.) and a few days after I sent the PDF over Fivver we received a fraudulent charge for 4 tickets to (of all places) SEAWORLD. It had the owners full name, address, email, phone number, and debit card. I at first thought this was the dev himself, but now after seeing this recent news I believe it could be Fivver directly - any thoughts would be appreciated!

831 points by morpheuskafka 6mo ago

rapfaria 6mo ago

How big of a client is Fiverr? Surely Cloudinary would have alerts for an enterprise client leaking stuff? Just insane

cleaning 6mo ago
Literally the first featured client on their landing page. Amateurs all the way down.

mtmail 6mo ago

You followed the correct reporting instructions. https://www.fiverr.com/.well-known/security.txt https://www.fiverr.com/.well-known/security.txt only has "Contact: security@fiverr.com" and in their help pages they say "Fiverr operates a Bug Bounty program in collaboration with BugCrowd. If you discover a vulnerability, please reach out to security@fiverr.com to receive information about how to participate in our program."

wxw 6mo ago

Wow, surprised this isn't blowing up more. Leaking form 1040s is egregious, let alone getting them indexed by Google...

snayan 6mo ago
I want to believe that it's people keeping mum until it's fixed so that the leaked PII isn't spread more widely, minimize the risk of bad actors scraping it all. Once the leak is plugged, I would hope that Fiverr gets absolutely raked over the coals, this is egregious.
- sizzle 6mo ago
  I wouldn’t be surprised if someone wrote a script to pull all the sensitive PII and it’s already on the dark net hacking forums for identity thieves. Freeze your credit at all bureaus if you ever used this site.
  - weird-eye-issue 6mo ago
    > Freeze your credit at all bureaus if you ever used this site. People should always have their credit frozen no matter what. It's free and only takes a few minutes to unfreeze when you need to apply for credit Yes it's a little bit inconvenient but so is suddenly having a car, insurance, and several iPhones in your name when somebody steals your identity...
    - oefrha 6mo ago
      My Experian score once took a substantial hit, dropping from ~800 to ~700 or something like that. Didn’t change elsewhere. I applied for the report and realized a quite significant debt appeared on my report, and it wasn’t even in my name! It was under someone else’s name that bore zero similarity to mine, or anyone in my family. Reported to Experian and it got fixed after a week or two. Zero explanation for how it happened. These credit reporting agencies are a joke.

deleted 6mo ago

[deleted]

mraza007 6mo ago

Woah that's brutal all the important information is wild in public

BoredPositron 6mo ago

Just by scrolling over it that's really rough.

popalchemist 6mo ago

Burn it to the ground.

smashah 6mo ago

They bought and.co and then dropped it. strange company

iwontberude 6mo ago

Loooool what a mess

xtracto 6mo ago
I just looked at the google search results... Holly cow... it is bad bad bad

impish9208 6mo ago

This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.

onraglanroad 6mo ago
I've read worse. Better than Dan Brown!
- b00ty4breakfast 6mo ago
  that bar is subterranean, haha
sergiotapia 6mo ago
Link please :pray:
- yapfrog 6mo ago
  [flagged]
  - Barbing 6mo ago
    Do you mind if I share your private documents if I come across them?
- IIsi50MHz 6mo ago
  Now returns Null for me, but looks like it was https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments/delivery/asset/e963e7803fa940c35ae182ee45af5908-1662827616/HNA%20full%20Source%20file.pdf https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/... Also, a version of this appears to be currently sold on Amazon for $15 USD.
  - 3abiton 6mo ago

johnmlussier 6mo ago

Probably not in scope but maybe https://bugcrowd.com/engagements/cloudinary https://bugcrowd.com/engagements/cloudinary will care? This is bad.

morpheuskafka 6mo ago
They probably wouldn't act immediately as there's no way for them to enable signing without breaking their client's site. The only cleanup you could do without that would be having google pull that subdomain I guess? (Fiverr itself uses Bugcrowd but is private, having to first email their SOC as I did.)

deleted 6mo ago

[deleted]

janoelze 6mo ago

really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.

mpeg 6mo ago
lots of admin credentials too, which have probably never been changed
- janoelze 6mo ago
  admin passwords to dating sites, that's the stuff people get blackmailed with
  - qq66 6mo ago
    How does someone's dating site password end up in Fiverr?
    - janoelze 6mo ago
      it's worse than you think – it's an admin password to the ~whole site~
      - xtracto 6mo ago
        Oh my. I feel for the tech team at fiverr. I'm sure it's nasty in there. Sending virtual hugs.
        bombcar 6mo ago
        They have a dating site password! They can get real hugs.
        ndsipa_pomu 6mo ago
        Meanwhile, I hope they get sent to prison for being so cavalier with other people's PII.

qingcharles 6mo ago

That's wild. Thousands of SSNs in there. Also a lot of Fiverr folks selling digital products and all their PDF courses are being returned for free in the search results.

walletdrainer 6mo ago

[flagged]

AndroTux 6mo ago
It kind of is, though. Google doesn't randomly try to visit every URL on the internet. It follows links. Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.
- xtracto 6mo ago
  Exactly , that's whyb"non public" github gists work. They are public, but not indexed anywhere "by default "
- Barbing 6mo ago
  Good thing, otherwise they would have exposed countless photos via Google Photos. Today, a photo file might be hosted at: photos.fife.usercontent.google.com/pw/[snip]=w[####]-h[####]-s-no-gm?authuser=0 But it used to be a little closer to: ...[google_site].com/[superLongAlphanumeric].jpg And no auth required, URL only!
- walletdrainer 6mo ago
  > Therefore, for these files to be indexed by Google, they need to be linked to from somewhere. So? That’s indeed how Google works. Google does not work how OP describes it. I’ve investigated similar incidents in the past on other platforms, it was always user error causing links to be public.
  - AndroTux 6mo ago
    The only thing that's user error here is the developers of Fiverr exposing files without proper session authentication.
    - walletdrainer 6mo ago
      That’s very often a deliberate design decision. It’s bizarre UX if you link a file to someone and the link doesn’t work.

yieldcrv 6mo ago

this is a bad leak, appreciate the attempts at disclosure before this

deleted 6mo ago

[deleted]

applfanboysbgon 6mo ago

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

morpheuskafka 6mo ago
They may be part of it, but as a publicly traded company, there's got to be a at least a few people there with a fancy pedigree (not that that actually means they are good at their job or care). But if such a test existed, they presumably would have passed it. They also have an ISO 27001 certificate (they try to claim a bunch of AWSs certs by proxy on their security page, which is ironic as they say AWS stores most of their data while apparently all uploads are on this).
- trollbridge 6mo ago
  A while ago I had a customer come to me who had a simple Shopify site and fell for a phishing type of attack where someone simply had an email like "shopify_security at gmail" and kept telling her she needed to apply all kinds of changes. They laundered the payments through Fiverr. Then they would install WordPress plugins to make the site worse and claim even more "work" was needed. I documented the entire thing, including my own credentials, and sent it off to Fiverr. Fiverr's response was everything was fine and there was nothing they could do about it, even though it was obvious fraud. Google never did anything about it either, nor did Shopify. Given how they handled such a minor situation like that... I guess it shouldn't be surprising they're just asleep at the switch for a major one like this.
- bluefirebrand 6mo ago
  > But if such a test existed, they presumably would have passed it Sure, and now they could have their credentials revoked, potential be legally liable, and never find work in this field again which would prevent them from cocking up another company this way

sergiotapia 6mo ago

This is really bad, just straight up people's income, SSN and worse just right there in the search results on Brave Search even.

HeliumHydride 6mo ago

It seems that someone sent a DMCA complaint months ago relating to this: https://lumendatabase.org/notices/53130362 https://lumendatabase.org/notices/53130362

avian 6mo ago
> Recipient: Google LLC This complaint was sent to Google, probably because the cloudinary.com URL appeared in their search results. It's doubtful anyone at Fiverr was made aware of this - unless Google typically forwards these complaints to the actual host of the offending URL. Even then, it would go to Cloudinary who would in turn need to notify their client. Many hops with plenty of "someone else's problem" barriers for the message to overcome.

gregsadetsky 6mo ago

I wrote to security@fiverr.com and they just replied: "You’re the second person to flag this issue to us Please note that our records show no contact with Fiverr security regarding this matter ~40 days ago unlike the poster claims. We are currently working to resolve the situation"

Loughla 6mo ago
So who has more incentive to lie, fiverr or OP?
- applfanboysbgon 6mo ago
  Is this even a question? Obviously, the company that has publicly posted people's tax forms on the internet is very trustworthy and we should eagerly believe everything they say. I don't think it even comes down to "lying". It's possible that they genuinely believe they didn't receive contact, but given that they are verifiably completely and totally incompetent and have no right to be employed in their current role, they've earned exactly zero benefit of doubt.
  - janoelze 6mo ago
    (weird to share any details about this incident to uninvolved parties via email anyway)
  - morpheuskafka 6mo ago
    @janoelze -- that was my thought too, though less so that they wouldn't share a claim of not being notified at all with a third party, but more that those kind of things need to go through legal/comms/etc not whoever runs the security mailbox. if the person running the email box is not the CISO, surely they at least need the CISOs approval to say something beyond a thank you or followup questions? (and if they are the CISO, then they have bigger things to worry about then replying...)
  - zelphirkalt 6mo ago
    Exactly, it doesn't have to be about them lying. It could simply be, that they let go or lost one of their engineers and that person knew why to do what and the next one didn't, accidentally exposing stuff.

psygn89 6mo ago

I guess they used Fiverr for security

janoelze 6mo ago

it's been 5 hours. even manual action to take down the most sensitive files should have completed about 3 hours ago at most. what is happening.

tag2103 6mo ago
Nothing- they are just hoping this will blow over.
- Barbing 6mo ago
  Do I have to start emailing the people in the leaked documents with screenshots?
  - oefrha 6mo ago
    Leaving a paper trail of you having accessed unauthorized private info is a bad idea, some crazy lawyer could decide to include you in a suit. Just not worth the hassle. Email a tip line about the general situation.
    - Barbing 6mo ago
      Good call!
    - Ekaros 6mo ago
      Not to forget some eager prosecutors. They can still try to prosecute for accessing material even if they end up losing. Lot of hassle there.
    - ndsipa_pomu 6mo ago
      How is it unauthorised if it's freely available via a search without having to bypass any login? It'd be like putting up an advert and then trying to sue anyone who sees it.
      - oefrha 6mo ago

pesus 6mo ago

Wow, the other comments weren't exaggerating. This is really bad. If my tax returns or other data were part of this, I might consider legal action. I wonder if somewhere like Wired/Ars Technica/404media might pick this up?

Barbing 6mo ago
Thanks, tip lines were a good idea
2Gkashmiri 6mo ago
https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments/delivery/asset/22548447ff6a0cb8b23505f4c935a0b3-1599833140/Terrasafe https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/... This is too funny
- TkTech 6mo ago
  Personally, this is the funniest one to me. It turns out Fiverr uses cloudinary for their internal documents as well. (Note: this one is not confidential and is public information) https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments-dev/generic_asset/asset/e43a09ebf5ec0954b2ff2b83f67b1964-1673810461528/FIVERR%20INTERNATIONAL%20LTD.%2027001.pdf https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...
  - 2Gkashmiri 6mo ago
    I saw that too. Ddg didn't give me a lot of results. Beyond a few dozen
  - dewey 6mo ago
    Shows you how much these certifications are worth in reality.
    - bblb 6mo ago
      Absolutely worthless pieces of paper. We had the ISO 270001 and the physical security "walk tour" or whatever it's called; I could've outsourced that to a bunch of preschoolers walking around the offices and data center rooms and would've gotten the same result. The only _actually_ working way to protect your org is to continuously attack your own systems and see what part of it breaks or leaks data.

cleaning 6mo ago

Wow this is really really bad. Insane this hasn't been fixed yet, media outlets are going to have a fun time with this story

fortran77 6mo ago

[flagged]

101008 6mo ago

There are health stuff too... and they are not even paying attention to this matter https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/v1/attachments/delivery/asset/6185f64c813689cc34ea5b9770223bc3-1667595208/WhatsApp%20Image%202022-11-03%20at%204.56.16%20PM.pdf https://fiverr-res.cloudinary.com/image/upload/f_pdf,q_auto/...

nikanj 6mo ago
Someone got an antivaxx certificate from Fiverr, not sure if that counts as delicate health information

ebbi 6mo ago

I've been boycotting Fiverr, so I'm glad I'm not caught up in this. And judging by their response to this issue, I'm glad I've been boycotting it.

morpheuskafka 6mo ago
I've never tried their platform, but I once made an account on Upwork and it is absolutely ridiculous. I'm sure they are very similar. People are asking for AWS help and giving root passwords to random contractors. A lot of people asking for CPA letters for loans and help with tax problems but their budget is under $100. And outright fraud posts are often seen asking for people to open bank accounts or otherwise bypass KYC. Upwork now has an AI feature to help write job posts, so all the time you can see things like "If you want to attract freelancers like X, I can change it." So now the job posts are all written like corporate ones talking about "highly experienced in X" but pay almost nothing. Half the time the clients don't even know the words in their own post. And it charges every time someone applies to a job and then more to boost to top of list because every job gets 30+ applications supposedly.
- mock-possum 6mo ago
  Upwork struck me as a straight up scam or pyramid scheme or something. Total turnoff.
- TZubiri 6mo ago
  I think the AI thing also transforms functional requirements into technical requirements, often incorrectly. "I want to build a website" gets converted into: "I'm looking for someone with 5+ years of 'hands on' React experience"

evmaki 6mo ago

Extremely bad stuff here. Can't believe it's been 7 hours now and you can still pull up people's complete prepared tax returns right from a Google search. This should be a business-ending breach of trust and good practices, but I worry there's probably a lack of regulatory might or will to make anything happen.

TkTech 6mo ago
It's very unfortunate but a significant amount of the most damaging stuff in this is from the underprivileged and those with minimal means who were trying to find help they could afford. Non-profits trying to get website help, confidential reports for charities trying to get translations, children seeking therapy (fiverr has a therapy category!?) for some truly dark stuff. Utterly inexcusable that this is still up after so many hours.
mellosouls 6mo ago
Technically, 40 days and 7 hours!
- ChrisMarshallNY 6mo ago
  ...and forty nights...
  - kkarpkkarp 6mo ago
    ...since you leaked my data away
deepserket 6mo ago
It looks like they (cloudinary?) blocked the content. Each result from the query site:fiverr-res.cloudinary.com form 1040 returns 404
- abustamam 6mo ago
  Yikes! It should not require the service provider to block PII, but at least someone plugged the leak.

Jbird2k 6mo ago

Bruh this stuff is still public

Barbing 6mo ago

@dang example query feels incredibly doxxy, and feels bad form to link directly to full copies of people's [stuff] and [personal info] as seen on this page :/ I know this is all Fiverr's fault for allegedly missing the responsible disclosure but now is this the ideal way for us to discuss, with these particular examples? I ask not to spare Fiverr, but I would be so mad if I were first for the result in OP or my personal info linked directly...

epaga 6mo ago
@dang I agree that some/many of these links should not be posted here.
- ratg13 6mo ago
  If this gets swept under the rug, it doesn't seem like they are going to do anything about it, and it will mean that only the bad people are going to be able to find this stuff.. who knows for how long.
BoredPositron 6mo ago
@dang doesn't work write an email if you mean your comment in a non performative way.
- epaga 6mo ago
  Oh? I've seen him respond to that many times in the past...assumed he had some hook for those.
  - rkomorn 6mo ago
    Correlation vs causation?
    - epaga 6mo ago
      Well, maybe.

figassis 6mo ago

From what I’ve seen, this always ends in some small fine/settlement and “no admission of guilt”. This type of protection is the source of these mishaps.

gagagagaga 6mo ago

[dead]

npilk 6mo ago

Remember, if you use Google to access any of this “private” information, you’re a hacker and the state of Missouri might try to arrest you! https://missouriindependent.com/2021/10/14/missouri-governor-vows-criminal-prosecution-of-reporter-who-found-flaw-in-state-website/ https://missouriindependent.com/2021/10/14/missouri-governor...

csomar 6mo ago

Given the existing DMCA requests and the fact that Google has become way less aggressive about indexing this stuff, it's clear this has been going on for a while. My guess is they've gutted enough of their internal processes that they literally can't restrict access to these files without breaking their own platform. You really can't make this shit up: https://www.linkedin.com/feed/update/urn:li:activity:7445526281590497280/ https://www.linkedin.com/feed/update/urn:li:activity:7445526... The real question is: will Fiverr be the first company to truly crash and burn from an "AI-first" approach? Go LLM, go mayhem!

AndroTux 6mo ago
> will Fiverr be the first company to truly crash and burn from an "AI-first" approach? No. Nobody will care.

gostsamo 6mo ago

have you contacted the ftc if their regulation is being violated?

fudged71 6mo ago

It's been 10 hours and all the links in this comment section still work...

csomar 6mo ago
If you use Google AI mode, it'll be happy to find you any kind of PII information.

ecommerce_app 6mo ago

[dead]

TZubiri 6mo ago

I don't get why disclosing is considered acceptable, it seems like racketeering to me, "pay up or else I'll make this hypothetical issue an actual issue for you" When I reported an issue and gotten no response, I sat on it for 6 years, reported it again and they took the whole site down without reaching out to me, never quite got it, but if people are doing this, it makes sense not to acknowledge any report and just play deaf.

nkrisc 6mo ago
What’s hypothetical? All this is and has been publicly accessible. Have bad actors already found it? Who knows? So if Fiverr isn’t going to fix it then the next best thing is to warn people.
morpheuskafka 6mo ago
Huh? I didn't ask for any money here or in the original email. (not that I couldn't use some, as I only have $1000 and four heavy suitcases right now, but anyway...) I did include "bug bounty" in the email subject since they claimed to have a private program. Other than that, no mention of any kind of compensation. It probably doesn't even have any kind of resume value since it's not an actual code flaw/CVE, just an "unlocked door."

epaga 6mo ago

I tried posting a warning to /r/fiverr but the admins removed the post. And the files are STILL public...how in the world is "sitting it out" their course of action? Edit: I'm beginning to wonder if they might be locked out of their own site at this point. How hard could it be to just shut down the asset server until they get it sorted?

morpheuskafka 6mo ago
The ironic thing is, since they clearly don't have much code review, they could have actually patched the site in this time! Turn on signatures and throw in a couple backend lines to generate one wherever the URLs appear. Even if you have to go back and redo it tomorrow for robust security or performance, it would be an improvement over this. I'm not taking sides either way, but if you are of the all in on AI perspective as they are, shouldn't this be the ideal use case? It absolutely could have handled adding URL signing.
elevatortrim 6mo ago
If the assets are public and not associated to my account, how could they ever restore access if they made them inaccessible?

viaredux 6mo ago

I am a freelancer on Fiverr, this is VERY concerning. The amount of PII that I have sent over Fiverr, after sending NDA's is potentially all out in the public. I hope there will be accountability for this. IMO Fiverr has had terrible management for years! They simply do not care about their freelancers (and apparently also not about their customers).

tdeck 6mo ago
Amazing that a company whose whole brand is based on hiring people for $5 turns out to not respect the workers who created value on their platform.
- viaredux 6mo ago
  I get your criticism, however, there was a lot of talent working on the platform for many years. I was averaging 150 USD per project, significantly more than 5 USD. Last year Fiverr started to push AI to the detriments of their freelancers, as well as a new "success score" metric, but never specifying how these metrics are calculated, making it very hard for freelancers to do something about it. This caused many accounts to "lose value" and thus rank lower on searches, causing a drop in income. I've reported this on the Fiverr Freelancer Forums, let's see how long my post stays up...
  - 21asdffdsa12 6mo ago
    There were also a ton of ArtIsts of the "Take the job, generate it with AI, throw the slop" rip and run kind of artistry.
    - tdeck 6mo ago
      Even before AI I remember reading that many of the "custom designed" logos on Fiverr were just ripoffs of existing trademarks.
      - aetherspawn 6mo ago

pcblues 6mo ago

In spite of how the pollies sell it, regulation is the friend of anyone earning less than one million dollars per year. Regulation would fix this. Get on it.

pcblues 6mo ago
Sorry, didn't make it clear. If a company does not publicly respond to a privately made security breach allegation, they are in breach of their responsibility to maintain business. If the breach is rubbish, the alleger looks bad. The best to you.

mark124mj 6mo ago

[dead]

unkl_ 6mo ago

Looks like the cloudinary links are returning 404 now

nslsm 6mo ago

I don't really see what the issue is here? Someone with access to the URL (either the freelancer or the client) leaked it to Google, Google crawled it. How is this Fiverr's fault? I mean, okay, they could sign URLs, but it's not like they left a folder with directory listing on. Someone with access to the URLs, not them, willingly made the URLs public.

aricooperdavis 6mo ago
Users should have to be authenticated to access the resource, not just rely on the URL being a secret.

Nekorosu 6mo ago

I was scammed on Fiverr myself, so I may be biased, but this feels consistent with the platform incentives I saw firsthand. The dispute process did not seem designed to deal well with coordinated abuse, and weak controls around sensitive files would point to the same broader issue: user safety and data handling do not appear to be high priorities.

gta6news 6mo ago

[dead]

yellow_lead 6mo ago

The files are deleted now, that was fun while it lasted!

morpheuskafka 6mo ago

Files are now returning 404s as of right now, 0900 UTC 4/15. Would be interesting if someone with an account can check if they are visible to intended users or not, and if so, if their mitigation is robust (signed URLs?).

viaredux 6mo ago
I have an account and I can confirm that the URL's of shared files are still publicly accessible. Google is giving 404's indeed.
- morpheuskafka 6mo ago
  Interesting. Did the URL scheme change with any expiry or signature params (like S3s X-Amz-Expires)?

viaredux 6mo ago

I tried to alert other freelancers on Fiver Forums about htis, but my post got deleted on for 'violating community rules'. I don't see how it did violate the rules, suspicious to say the least.

mellosouls 6mo ago

Now being reported more widely, linked back to OP, eg: https://cyberinsider.com/fiverr-exposes-sensitive-data-via-public-urls-indexed-by-google/ https://cyberinsider.com/fiverr-exposes-sensitive-data-via-p... https://cybernews.com/security/fiverr-leak-exposes-user-ids-contracts-data/ https://cybernews.com/security/fiverr-leak-exposes-user-ids-...

mellosouls 6mo ago

For anybody who missed OPs bit at the end: Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply.

dbg31415 6mo ago

Fiverr probably hired someone from Fiverr to do the web build security.

everdrive 6mo ago

Yet another in the innumerate examples of privacy statements being completely meaningless. I do think it is important to call this out when it happens, but I'm hardly surprised.

vswaroop04 6mo ago

Obvious! They dont care about freelancers

agent-kay 6mo ago

[flagged]

hoofhearted 6mo ago

Still publicly available. Just forwarded this post to a few members of Congress.

viaredux 6mo ago

Update: Fiverr denies allegations of a cybersecurity incident on X. “To be clear, this is not a cyber incident. Fiverr does not proactively expose users’ private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer’s consent before it can be uploaded. As always, any request to remove content is handled promptly by our team.”

xtrial972 6mo ago
this is because you copied the link with the token, token is generated for your logged in user. strip the token and it wouldn't work. other users does not have your token.
- viaredux 6mo ago
  That's true, I just checked. I will edit my post, thanks!
- ChrisMarshallNY 6mo ago
  You send the bearer token as a GET argument? I’m sure there’s a good reason for that. I do it, in a server that I publish for general use, but won’t do it, for the server that I control, as I make sure that it reads headers. Some PHP servers ignore auth headers (and, I suspect, other APIs), so you need to set general-purpose frameworks and servers to use GET arguments, but that’s a security issue, for exactly the reason you state. Too easy to leak logins. If you use headers, then copy and pasting URLs won’t leak logins. In any case, the token should be timed, but that’s a fairly weak precaution.

eudamoniac 6mo ago

The stock hasn't moved. Puts?

deepserket 6mo ago

Answer from Fiverr: "To be clear, this is not a cyber incident. Fiverr does not proactively expose users' private information. The content in question was shared by users in the normal course of marketplace activity to showcase work samples, under agreements and approvals between buyers and sellers. This type of content requires the buyer's consent before it can be uploaded. As always, any request to remove content is handled promptly by our team." https://x.com/fiverr/status/2044389801495773339?s=20 https://x.com/fiverr/status/2044389801495773339?s=20

viaredux 6mo ago
I also commented this, but I have to say their statement is false. The links to all the delivered projects are publicly accessible. I went over my orders and I could open every single one from another device, not logged in.
- xtrial972 6mo ago
  this is because copied the link with the token, token is generated for your logged in user. strip the token and it wouldn't work

preetigagarwal 6mo ago

[dead]

MyUltiDev 6mo ago

The Cloudinary fix that nobody in this thread is naming is actually two lines. Upload the asset with type set to authenticated instead of the default upload type, and generate a signed URL server side with sign_url true whenever alogged in user requests it. Once the asset is authenticated the public URL stops resolving entirely, so even the Google indexed copies go cold. The reason Fiverr cannot just turn this on now is that they already have years of stored messages where every reference is the default public delivery type, and switching the existing media library from public to authenticated breaks every existing URL across the whole platform. That is the architectural brittleness someone upthread was pointing at, and it is also why the only realistic path forward for them is rotating new uploads to authenticated and accepting that the historical exposure is permanent. What would actually catch this category of mistake earlier, an SDK default that refused to upload anything as public unless you opt in?

cheesecaxe666 6mo ago

[dead]

weird-eye-issue 6mo ago

This is still live???

laurakalninaaa 6mo ago

[dead]

maryjeiel 6mo ago

[flagged]

matrixgard 6mo ago

[dead]

thomasquarre 6mo ago

[dead]

ttrinity 6mo ago

Non-dev here, I think the small business I work for was involved in this data leak. I started a project with a developer on Fivver - he is very well rated and has an extensive portfolio, so I felt comfortable working with him. Last week, he gave me a requirement document that I filled out with our info (stripe integration API keys, domain access, etc.) and a few days after I sent the PDF over Fivver we received a fraudulent charge for 4 tickets to (of all places) SEAWORLD. It had the owners full name, address, email, phone number, and debit card. I at first thought this was the dev himself, but now after seeing this recent news I believe it could be Fivver directly - any thoughts would be appreciated!