American Archive of Public Broadcasting site bug addressed

American Archive of Public Broadcasting, a public nonprofit digital audio and video archive operated by the Library of Congress and WGBH Educational Foundation, has fixed a vulnerability in its website, which has been exploited to enable restricted media downloads since 2021, BleepingComputer reports.

Intrusions involved the exploitation of an insecure direct object reference flaw through a Tampermonkey script that modified media access requests' media ID parameter, allowing access to protected or private media resources, according to an anonymous cybersecurity researcher. Threat actors could also leverage in background fetch or XMLHttpRequest calls to evade access controls implemented in main /media/{ID} pages.

Such a security issue was initially rumored following the exposure of Sesame Street's "Wicked Witch of the West" episode on the Lost Media Wiki Discord channel, which Lost Media Wiki removed after noting potential acquisition from a data breach.

Other protected content had been leaked on Discord servers using the exploit since then. Such a development comes after PBS reported the leak of its employees' contact details on Discord servers for PBS Kids.