Secret Access Key of AWS Firehose Disclosure

How it was found

The ███████ domain has the /error_docs/uat.js endpoint, which contains the secret access key of AWS Firehose encoded in base64.

The secret access key has permission to put the record.

Impact

The attacker could repeatedly send massive amounts of data to the Firehose delivery stream, causing:

• Increased costs due to higher data processing charges.
• Potential overloading of downstream systems (e.g., S3, Redshift, or Elasticsearch) if the Firehose delivery stream forwards the data to such services.

System Host(s)

███████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1. Go to █████████.
2. Decode the base64 encoded string found in the file: ███
3. Use the secret access key and related metadata information to put the record.

The attached image shows that I can put the record.

Suggested Mitigation/Remediation Actions