3

I've been testing sharing files from iCloud when I accidentally stumbled onto this bug.

Steps to Repro:

  • In Firefox preferences, set "Portable Document Format" download action to always ask.

enter image description here

  • Log into iCloud.com and tap on a PDF file's name (Blue URL) to download it but, instead of saving it, Select Open with other.. and choose Firefox.app in the app list.

  • The file will display right in the browser as expected. Now, copy the link in the address bar: https://cvws.icloud-content.com/B/[loooong_string] and take that link to a different browser altogether with no iCloud login.

The file is still openly accessible. To anyone with that link!

Yes, granted it's not the type of a link to be easily guessed but the file was NOT intentionally shared or made available via a link and NO authentication was needed to access it.

Is this behavior by design? Gaining access to this link appears to be posing a huge security risk, isn't it?

Improve this question
4
  • I cannot reproduce this.. I opened a numbers file in Safari.. It had URL like icloud.com/numbers/<The-key> and I opened the URL in private mode and it asked for password. Where did you get this cvws link ?
    – anki
    Commented Oct 17, 2019 at 19:07
  • @ankii Thanks for looking into this... I'm in Firefox and yes, the cvws.icloud-content.com... is the link I get in the address bar when I double-click an image (jpg in my case) as described above.
    – Pawel
    Commented Oct 17, 2019 at 20:19
  • 1
    @ankii ...also note that this pertains to iCloud Drive > Desktop & Documents Folders content, not native Apple apps, such as Numbers (with those I do get the same link you've mentioned)
    – Pawel
    Commented Oct 17, 2019 at 20:52
  • FB7389134 include this ID in case someone reports this. feedbackassistant.apple.com.
    – anki
    Commented Oct 17, 2019 at 22:01

1 Answer 1

Reset to default
2

I filed a bug report.

Them:

Can you please set up such a file (not shared) and then send us the link so that we can confirm we are able to access it despite your intent not to share?

Thanks,

Me: Here's the link.

Me, later: The link shows "gone" after some time. Here's another.

Them:

This is by design. The link URL will expire.

Thank you for your feedback.

Improve this answer
1
  • The expiry of the link is actually pretty annoying, because if you want to send someone a file download link without the landing page or have a link you can wget at any time, it will not be possible to do so. You would have to host it yourself on a web server.
    – Felix An
    Commented Dec 19, 2023 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .