1645285 - S3 Misconfiguration that leads to expose S3 Bucket ACL @ charts.mozilla.org publicly

Status: RESOLVED INVALID

(Cloud Services :: Security, defect)

Description

[Ali Fathi Ali Sawehli]

Attachment: Screenshot 2020-06-12 at 11.45.30 AM.png

Dear Mozilla team,

Thanks for your amazing services,

I would like to report an issue that I came across to it.

Upon doing the vulnerability assessment on charts.mozilla.org, I was able to find an S3 misconfiguration that allows any users to get the bucket ACL publicly.

To reproduce:

1- Type the following command in the terminal:

aws s3api get-bucket-acl --bucket charts.mozilla.org

2- it will print the bucket ACL as the below screenshot.

Impact

This gives more information about your buckets to an attacker that is looking to attack you.

Also, considering that it's possible to set the wrong ACL on a file that you may upload and may be confidential in the bucket, a secure bucket will remove the possibility to access it without proper authentication.

To mitigate this risk, you can set a role to deny any public request from accessing to the Bucket ACL.

I would be happy to answer your questions if there is any.

Best regards,

Ali Fathi

Comment 1

[AJ Bahnken [:ajvb] (she/her)]

Thank you for your bug report Ali!

This is a bucket for a website that only hosts publicly accessible graphs. The information shown from the ACL does not provide anything that is not already publicly available. As a result, I do not think that this poses a risk.

Comment 2

[Ali Fathi Ali Sawehli]

Hi AJ Bahnken

Thanks for your response.

Basically, this security misconfiguration falls under "Improper ACL permission" exposes the name of the AWS infrastructure. As we can see in the screenshot above. The attacker will be able to now the existing users and their privileges, and then start attacking them to gain unauthorized access. In this case, we were able to identify that you have a user called "aws-ateam" who has a write and read access to the bucket. This S3 ACL information should be always private and not exposed publically.

In order to prevent this security issue, you can disable the read public ACL access for this bucket.

Here is an article explains S3 security misconfiguration and includes this issue: https://www.virtuesecurity.com/aws-penetration-testing-part-1-s3-buckets/

I would be happy to answer your questions.

Comment 3

[AJ Bahnken [:ajvb] (she/her)]

Hey Ali Fathi,

The attacker will be able to now the existing users and their privileges, and then start attacking them to gain unauthorized access.

Were you able to do anything with this information?

Comment 4

[Ali Fathi Ali Sawehli]

Hey AJ Bahnken,

It gives who has access to this bucket along with its permission.

Here is a deep dive : https://labs.detectify.com/2017/07/13/a-deep-dive-into-aws-s3-access-controls-taking-full-control-over-your-assets/

Comment 5

[AJ Bahnken [:ajvb] (she/her)]

Information Disclosure on it's own is not eligible within our bounty program, which you can read more about here: https://www.mozilla.org/en-US/security/web-bug-bounty/

Thank you again for your report Ali.