Publicly Accessible CDN Endpoint Exposing XML Metadata (including ETag)

How it was found

A CDN URL (█████████) was found that returns raw XML listing of stored objects. The XML includes Key, LastModified, Size, StorageClass, and ETag (object hash/identifier). While the actual files are access-controlled, the metadata and ETag values are publicly visible.

References

ETag behavior: Single-part S3 uploads typically set ETag equal to the MD5 of the object; multipart uploads produce non-MD5 ETags (multipart marker present). Treat any exposed ETag as a potential fingerprint.

Recommend immediate review of CDN/S3 configuration and access logs.

Impact

Metadata & ETag exposure: Filenames, timestamps, sizes, and ETags give an attacker reconnaissance data to map internal content and activity patterns.

File fingerprinting: ETags often contain a hash (commonly MD5 for single-part S3 objects). Exposed hashes can let an attacker:

Confirm that a given file matches a known file elsewhere (fingerprinting).

Detect duplicate files or specific versions.

Correlate content across systems (if the same hash appears in other leaks/public repos).

Accidental disclosure risk: If sensitive files are uploaded accidentally, they may be identified quickly via metadata or ETag.

Compliance & posture: Public exposure of metadata and hashes is a misconfiguration that can conflict with NIST/DoD guidelines.

Publicly accessible CDN storage endpoints that expose raw bucket listings have little security benefit and are largely unnecessary in modern architectures. Modern CDNs (CloudFront, Akamai, etc.) can serve only the intended public assets without exposing the underlying storage metadata. Leaving the bucket itself listable increases the attack surface with no operational need.

System Host(s)

█████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Visit ██████████

Suggested Mitigation/Remediation Actions

Disable public listing of the storage bucket/CDN endpoint (prevent ListBucket/directory responses).

If listing is required for legitimate public content, serve only intended objects via a CDN front that does not expose the raw bucket index or ETag values.

Use signed/presigned URLs for controlled distribution of non-public content.

Consider removing ETag/hash fields from publicly accessible listings if feasible, or return truncated/opaque identifiers instead of raw hashes.

Audit stored objects for accidentally uploaded sensitive content and monitor for enumeration attempts.