Tumblr security hole: does this work for you?

4 points

14 years ago

Recently, after some playing with the chromium debugger in the Tumblr blog customize panel, I discovered that just about any theme (including premium) can be downloaded via a simple wget command:

wget http://tumblr.com/customize_api/theme/34426 --post-data="Origin: http://www.tumblr.com"

This would download a JSON object which contains the theme file (under the "theme" field).

In this case, the theme I've downloaded is Paperback (http://www.tumblr.com/theme/34426); As you can see, the theme is premium and requires a 49$ fee to use. I can just copy the theme code from the JSON I downloaded, paste it in "Edit HTML" and use that theme for free.

I do not advise anyone to do it, but it's worth exploring. Of course, if the theme code leaks, it can be easily pirated, but don't you think being able to just download every single theme is a little too far?

Try this: wget http://tumblr.com/customize_api/theme/8952 --post-data="Origin: http://www.tumblr.com" (rank & file) Or wget http://tumblr.com/customize_api/theme/15063 --post-data="Origin: http://www.tumblr.com" (Fluid 2)

You can browse the themes to fetch the ID's using the Tumblr theme garden (http://tumblr.com/themes) or by browsing this JSON object: http://www.tumblr.com/customize_api/themes