A significant cybersecurity vulnerability at the American Archive of Public Broadcasting (AAPB) allowed unauthorized access to protected and private media content for several years before being quietly patched this month.
## The Vulnerability Discovery
The security flaw was brought to light by an anonymous cybersecurity researcher who contacted BleepingComputer. According to the researcher, the vulnerability had been actively exploited since at least 2021, despite being previously reported to the organization. After BleepingComputer contacted AAPB about the issue, the organization confirmed the problem and implemented a fix within 48 hours.
“We’re committed to protecting and preserving the archival material in the AAPB and have strengthened security for the archive,” stated Emily Balk, AAPB’s Communications Manager. “We look forward to continuing to make public media history free and accessible to the public.”
## About the American Archive
The American Archive of Public Broadcasting is operated jointly by the WGBH Educational Foundation (GBH) and the Library of Congress. This public nonprofit organization focuses on collecting, digitizing, and preserving historically significant content from American public radio and television.
## How the Exploit Spread
The vulnerability first gained attention through online discussions about the leaked Sesame Street “Wicked Witch of the West” episode on the Lost Media Wiki Discord channel. Lost Media Wiki subsequently removed the episode, stating it was “likely obtained in an illegal data breach.”
By mid-2024, the exploit method had spread throughout Discord preservation communities, leading to additional leaks of protected content. These communities, often called “data hoarders,” specialize in archiving various forms of digital media but frequently operate in legal gray areas regarding copyrighted material.
## Technical Details of the Exploit
The vulnerability was surprisingly simple to exploit. It involved an Insecure Direct Object Reference (IDOR) flaw that could be exploited using a basic Tampermonkey script. The bug allowed users to:
– Bypass AAPB’s access controls by manipulating media ID parameters
– Access protected or private resources using valid media IDs
– Circumvent security measures through background fetch or XMLHttpRequest calls
While the main media pages had some access controls, attackers could easily bypass them. Instead of receiving a proper “403 Forbidden” error, the server would serve the content as long as the request contained a valid media ID.
## Broader Implications
This incident highlights ongoing security challenges faced by digital archives and cultural institutions. It also demonstrates how preservation communities, despite often having good intentions, can inadvertently facilitate unauthorized access to sensitive content.
The AAPB breach follows another incident earlier this year involving leaked PBS employee contact information that spread through Discord servers dedicated to PBS Kids content, illustrating a pattern of security vulnerabilities affecting public broadcasting organizations.
## Current Status
While the vulnerability has been patched, the full extent of accessed and shared content within data hoarder communities remains unknown. The incident serves as a reminder of the importance of robust security measures for organizations handling sensitive digital archives and the need for regular security audits of web applications.