3

I've been testing sharing files from iCloud when I accidentally stumbled onto this bug.

Steps to Repro:

  • In Firefox preferences, set "Portable Document Format" download action to always ask.

enter image description here

  • Log into iCloud.com and tap on a PDF file's name (Blue URL) to download it but, instead of saving it, Select Open with other.. and choose Firefox.app in the app list.

  • The file will display right in the browser as expected. Now, copy the link in the address bar: https://cvws.icloud-content.com/B/[loooong_string] and take that link to a different browser altogether with no iCloud login.

The file is still openly accessible. To anyone with that link!

Yes, granted it's not the type of a link to be easily guessed but the file was NOT intentionally shared or made available via a link and NO authentication was needed to access it.

Is this behavior by design? Gaining access to this link appears to be posing a huge security risk, isn't it?

Improve this question
4
  • I cannot reproduce this.. I opened a numbers file in Safari.. It had URL like icloud.com/numbers/<The-key> and I opened the URL in private mode and it asked for password. Where did you get this cvws link ?
    – anki
    Oct 17, 2019 at 19:07
  • @ankii Thanks for looking into this... I'm in Firefox and yes, the cvws.icloud-content.com... is the link I get in the address bar when I double-click an image (jpg in my case) as described above.
    – Pawel
    Oct 17, 2019 at 20:19
  • 1
    @ankii ...also note that this pertains to iCloud Drive > Desktop & Documents Folders content, not native Apple apps, such as Numbers (with those I do get the same link you've mentioned)
    – Pawel
    Oct 17, 2019 at 20:52
  • FB7389134 include this ID in case someone reports this. feedbackassistant.apple.com.
    – anki
    Oct 17, 2019 at 22:01

1 Answer 1

Reset to default
1

I filed a bug report.

Them:

Can you please set up such a file (not shared) and then send us the link so that we can confirm we are able to access it despite your intent not to share?

Thanks,

Me: Here's the link.

Me, later: The link shows "gone" after some time. Here's another.

Them:

This is by design. The link URL will expire.

Thank you for your feedback.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .