Open S3 Bucket Accessible by any User
O
Omise
Submitted None
Actions:
Reported by
ravansurya
Vulnerability Details
Technical details and impact analysis
hi team,
here i found Open S3 Bucket Accessible by any User
vulnerable URL:
https://cdn2.omise.co/
bucket name : `omise-cdn-2`
I haven't tried this yet as it may delete the bucket. (it is possible)
an Attacker can delete the bucket using this command:-
$ aws s3 rb s3://<The_bucket_name>
and claim the bucket again to takeover the bucket
https://cdn2.omise.co/. (S3 misconfiguration), that allow to any user listing/read/download all folders/files.
i think somthing misconfiguration is happaening here, u cant read the bucket using Aws Cli but u can read it via browser.
and also u can download the file using both Aws Cli and Browser.
████████
download:
██████
## Impact
Sensitive information Leakage.
an Attacker can delete the bucket .and claim the bucket again to takeover the buckaet
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$100.00
Submitted
Weakness
Information Disclosure