10 Non-Obvious S3 Integration Vulnerabilities Exposed in Web Application Bug Bounty Research

Security researcher Sergey Bobrov aka BlackFan has released an in-depth practical guide on non-obvious vulnerabilities arising from S3 integrations in web applications. Working at Positive Technologies and participating in Standoff Bug Bounty, Bobrov demonstrates ten laboratory environments that expose misconfigurations when object storage is connected through proxies such as nginx.

The analysis begins with core S3 operations (PUT, GET, DELETE, and bucket listing) and authorization mechanisms using Access Key and Secret Key pairs with v2 and v4 signatures. It contrasts two common integration patterns: direct client calls limited to method parameters and proxy configurations that expose the full protocol surface because nginx rarely filters methods or headers beyond the path prefix.

Proxy Rule Errors and Bucket Takeover

One stand demonstrates how omitting a trailing slash in a /static proxy rule allows an attacker to create a bucket matching the original prefix and serve malicious files such as xss.html that execute stored XSS through the legitimate site. Another case exploits the $uri variable containing decoded paths, enabling HTTP Request Splitting via spaces and newlines to rewrite the Host header and exfiltrate session cookies including HttpOnly values to an attacker-controlled bucket.

Using Ceph RGW, researchers bypass rewrite rules by injecting %0A after the static prefix, causing the regular expression to fail and allowing arbitrary bucket access with a preserved postfix. Similar path traversal with ../ sequences succeeds against Ceph RGW because it does not normalize paths like traditional filesystems, permitting requests to internal buckets such as public.

Cache Poisoning and Protocol Abuse

Cache poisoning is shown when query parameters like ?response-content-type=image/png alter the Content-Type returned by S3 while the nginx cache key ignores parameters, serving the poisoned response to all subsequent visitors for one minute. Additional vectors include enabled bucket listing combined with unauthenticated PUT uploads that permit direct stored XSS, and signed URL endpoints that leak entire bucket listings when a slash is supplied instead of a specific object path.

The research supplies an S3 Fingerprint table and a Burp Suite extension for rapid identification of systems including MinIO, Ceph RGW, and Yandex Cloud via headers such as X-Amz-Request-Id and error page formats. All demonstrations stress that the findings are educational and intended to help defenders secure their deployments.