Greenhouse.io · Report #819278

Open S3 Bucket Accessible by any Aws User

Validstatus

lowseverity

$100bounty

53upvotes

1 May 2020disclosed

How it was found

hi team,

vulnerable URL: http://grnhse-marketing-site-assets.s3.amazonaws.com/

There is no authentication required to access the AWS bucket of the website. As your site was associated with AWS, any AWS user can view the content , navigate through directories and download files, public access is allowed.

proof of concept: Please refer the screenshots attached.

[ note: I haven't modified any existing resources or harm any content ]

Impact

```
 Sensitive information Leakage.
```

 Information disclosure about all the data in the cloud.

I haven't tried this yet as it may delete the bucket. (it is possible) an Attacker can delete the bucket using this command:- $ aws s3 rb s3://<The_bucket_name> and claim the bucket again to takeover the bucket

solution: secure the login access

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original