# File access controls incorrectly enforced for files shared via QuickLink - Unshared files can be accessed

QuickLink bundle download validated the path with a prefix match, so a shared file 'foo' let attackers download 'footer.php' and files under 'foobar/'.

- Payout: $600
- Severity: medium
- Program: Files.com
- Credited: eboda
- Disclosed: 2017-04-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/214001
- Library page: https://bugbountylibrary.com/r/h1%3A214001
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:access-control vuln:idor

**Target:** QuickLink bundle download endpoint (/bundles/download)
**Root cause:** The bundle access check compared the requested path against the shared filename using a string prefix match instead of exact path equality, so any path beginning with the shared name passed validation.
**Steps:**
1. Create files `foo`, `bar`, `footer.php` and folder `foobar/secret`.
2. Share `foo` via Copy Public QuickLink, producing a bundle code (e.g. `23a17148e`).
3. Observe download request `GET /bundles/download?code=23a17148e&path=foo&x=<session-token>`.
4. Change `path` to `bar` -> 'Invalid path for bundle'.
5. Change `path` to `footer.php` (prefix `foo`) -> file downloads.
6. Change `path` to `foobar/secret` -> file inside folder downloads.
**How found:** Noticed the download URL carried the filename in a `path` parameter, tested a non-matching name (`bar`) to confirm validation existed, then hypothesized prefix-based comparison and confirmed with `footer.php` and `foobar/`.
**Exploitation:** Attacker with a valid QuickLink bundle code and session token rewrites the `path` parameter to any file whose name shares the shared file's prefix, downloading unshared files from the same site.
**Insight:** When a download endpoint takes a filename as a parameter, test prefix/suffix collisions (e.g. shared `foo` vs `footer.php`, `foobar/`) to detect startsWith-style access checks instead of exact-match.