Udemy · Report #131468
AWS S3 bucket writable for authenticated aws user
Validstatus
13upvotes
5 Jan 2017disclosed
How it was found
Hey,
I found an open S3 Amazon bucket udemy-maven. While I can’t confirm if you own it or not, it appears that it is publicly writable using the aws cli.
When I write to udemy-maven, I get: move: ./test.txt to s3://udemy-maven/test.txt
And also when I remove file, I get: delete: s3://udemy-maven/test.txt
Assuming you own it, the security issue is that someone could delete files or write something malicious into the bucket and someone on your team unknowingly opening it.