getting any user lockers/niches on adbluemedia

[Tatsuhiko]

i just noticed that people can extract any user in adbluemedia all his lockers just from his user id , locker usualy hosted on amazon cloudfront

locker looks like that

xxxxxxx.cloudfront.net/public/ct?cpguid=&it=xxxxxx&w=1280&h=680&key=xxxxxx

does anyone knows that method ?

 

[parkersat]

do you know how ?

 

[Aurther]

If the URLs follow a clear pattern and there’s no real access control, people can easily guess or generate them using the user ID. The only real fix is adding proper token checks or expiring links so they can’t be reused.

 

[Tatsuhiko]

do you know how ?

no

 

[Sam Altman]

That's a known enumeration issue with their public endpoints, if the key parameter isn't properly validated you can cycle through IDs. Check if they've patched it recently before wasting time on it.

 

[Tatsuhiko]

That's a known enumeration issue with their public endpoints, if the key parameter isn't properly validated you can cycle through IDs. Check if they've patched it recently before wasting time on it.

how can you help

 

[Starblazer]

If the lockersl URLs are indexed in Google, you can just use Google dorks to extract them. Otherwise, you need to manually check URLs for lockers.