2

I've been testing sharing files from iCloud when I accidentally stumbled onto this bug.

Steps to Repro:

  • In Firefox preferences, set "Portable Document Format" download action to always ask.

enter image description here

  • Log into iCloud.com and tap on a PDF file's name (Blue URL) to download it but, instead of saving it, Select Open with other.. and choose Firefox.app in the app list.

  • The file will display right in the browser as expected. Now, copy the link in the address bar: https://cvws.icloud-content.com/B/[loooong_string] and take that link to a different browser altogether with no iCloud login.

The file is still openly accessible. To anyone with that link!

Yes, granted it's not the type of a link to be easily guessed but the file was NOT intentionally shared or made available via a link and NO authentication was needed to access it.

Is this behavior by design? Gaining access to this link appears to be posing a huge security risk, isn't it?

| improve this question | | | | |
  • I cannot reproduce this.. I opened a numbers file in Safari.. It had URL like icloud.com/numbers/<The-key> and I opened the URL in private mode and it asked for password. Where did you get this cvws link ? – ankii Oct 17 '19 at 19:07
  • @ankii Thanks for looking into this... I'm in Firefox and yes, the cvws.icloud-content.com... is the link I get in the address bar when I double-click an image (jpg in my case) as described above. – Pawel Oct 17 '19 at 20:19
  • @ankii ...also note that this pertains to iCloud Drive > Desktop & Documents Folders content, not native Apple apps, such as Numbers (with those I do get the same link you've mentioned) – Pawel Oct 17 '19 at 20:52
  • FB7389134 include this ID in case someone reports this. feedbackassistant.apple.com. – ankii Oct 17 '19 at 22:01
1

I filed a bug report.

Them:

Can you please set up such a file (not shared) and then send us the link so that we can confirm we are able to access it despite your intent not to share?

Thanks,

Me: Here's the link.

Me, later: The link shows "gone" after some time. Here's another.

Them:

This is by design. The link URL will expire.

Thank you for your feedback.

| improve this answer | | | | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .