# Differential "Show Raw File" feature exposes generated files to unauthorised users

Phabricator's "Show Raw File" generates a File object without inheriting the diff's view policy, letting any user enumerate file IDs to read private diffs.

- Payout: hidden
- Severity: medium
- Program: Phabricator
- Found by: calvium
- Disclosed: 2017-03-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/213942
- Library page: https://bugbountylibrary.com/r/h1%3A213942
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium technique:recon vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Differential "Show Raw File" generated File endpoint
**Root cause:** Files generated by the "Show Raw File" diff feature are created without inheriting the source diff's view policy, so they default to a broader visibility than the diff they were derived from.
**Steps:**
1. Log in as user A in browser 1 and user B in browser 2.
2. As user A, create a new diff visible only to yourself and update it several times.
3. As user B, confirm the diff page is restricted.
4. As user A, on the diff page click `View Options` > `Show Raw File (Right)` to generate a File.
5. As user B, enumerate file ID pages until hitting the generated file's ID and download the private diff content.
**How found:** Noticed that the raw file generated from a restricted diff remained accessible to a second user, then confirmed the generated File does not inherit the diff's policy.
**Exploitation:** Any authenticated user enumerates sequential file IDs (scriptable) to retrieve generated raw-diff files belonging to diffs they cannot view, disclosing other users' private code.
**Insight:** Features that materialize derived artifacts (raw diffs, exports, previews) often create new objects with default policies rather than inheriting the source object's policy; test whether the derived object's ID is enumerable and independently fetchable.