Open S3 Bucket WriteAble To Any Aws User
High
R
Ruby
Submitted None
Actions:
Reported by
injector404
Vulnerability Details
Technical details and impact analysis
Hi All,
I know that http://rubyci.s3.amazonaws.com is used for file uploads on reports and so when i open your s3 bucket i able see all of your public/private files i already see you fix this vulnerability but it not completely fixed
root@injector:~# aws s3 ls s3://rubyci
PRE aix71_ppc/
PRE amazon/
PRE arch/
PRE archive/
PRE armv8b/
PRE c64b/
PRE centos5-32/
PRE centos5-64/
PRE centos7/
PRE debian/
PRE debian7/
PRE debian8/
PRE f19p8/
PRE fedora20/
PRE fedora21/
PRE fedora22/
PRE fedora23/
PRE fedora24/
PRE fedora25/
PRE freebsd10-zfs/
PRE freebsd11zfs/
PRE freebsd82-32/
PRE freebsd82-64/
PRE funtoo/
PRE gentoo/
PRE icc-x64/
PRE opensuse13/
PRE opensuseleap/
PRE osx1010/
PRE osx1011/
PRE rhel_zlinux/
PRE scw-9d6766/
PRE tk2-243-31075/
PRE ubuntu/
PRE ubuntu1004-32/
PRE ubuntu1004-64/
PRE ubuntu1404/
PRE ubuntu1410/
PRE ubuntu1510/
PRE ubuntu1604/
PRE unstable10s/
PRE unstable10x/
PRE unstable11s/
PRE unstable11x/
2017-02-17 13:03:14 112 test.html
2017-02-27 09:52:15 20 test.txt
any one who have aws s3 cli can write in your bucket because your bucket writable through aws cli
when i try to move and delete any file on your bucket i got this
###MOVED
root@injector:~# aws s3 mv test.txt s3://rubyci
move: ./test.txt to s3://rubyci/test.txt
###DELETED
root@injector:~# aws s3 rm s3://rubyci/test.txt
delete: s3://rubyci/test.txt
any one using aws cli can move and delete any file from your bucket
also check the attached picture and feel free to contact if you need any additional info
Best Regard
Saad Ahmed
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Improper Authentication - Generic