AWS S3 Bucket Misconfiguration Exposes PII and Documents of Job Seekers

Hello, my name is Biraj Baishya, also known as brutexploiter. I am an independent security researcher, a full-time bug bounty hunter, and a mechanical engineer.

In this write-up, I will discuss how I discovered a critical vulnerability and protected the data of job seekers from a misconfiguration that could have been exploited by cyber attackers, potentially leading to a data breach.

The discovery phase of the vulnerability was quite interesting because I visited the Oil India Limited website as a job seeker. Oil India Limited had recently announced job openings for various technical positions, so I visited the site to download the admit card for the examination. Suddenly, during the downloading process, I noticed that the documents were being served from an Amazon Web Services (AWS) S3 Bucket.

I thought, ‘Let’s play around a little bit.’ The first thing I did was try accessing another directory, but I had no luck. However, when I visited the S3 bucket URL directly, I noticed that files were listed on the page. I attempted to access one of the files displayed and succeeded. As I accessed the contents of the bucket, I noted that it was set to be publicly accessible. Having recently received a private invitation from the Amazon AWS Bug Bounty program on Bugcrowd (which has now moved to HackerOne), I was conducting some testing and knew what a private S3 bucket should look like.

AWS stands for Amazon Web Services which is a secure cloud services platform, offering compute power, database storage, content delivery and other functionalities.

Amazon S3 stands for Amazon Simple Storage Service which is an object storage service that offers industry-leading scalability, data availability, security, and performance.

The next thing I did was start reading AWS S3 documentation for a better understanding.

Documentation: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/index.html

I also found many articles about AWS S3 Bucket misconfiguration. After reading them, I prepared my environment for testing.

ACLs

Amazon S3 considers a bucket or object ACL public if it grants any permissions to members of the predefined AllUsers or AuthenticatedUsers groups.

Bucket policies

When evaluating a bucket policy, Amazon S3 begins by assuming that the policy is public. It then evaluates the policy to determine whether it qualifies as non-public. To be considered non-public, a bucket policy must grant access only to fixed values (values that don’t contain a wildcard or an AWS Identity and Access Management Policy Variable) for one or more of the following:

Example : Public bucket policies

Under these rules, the following example policies are considered public.

Useful AWS CLI Commands

ls

List S3 objects and common prefixes under a prefix or all S3 buckets. Note that the — output and — no-paginate arguments are ignored for this command.

cp

Copies a local file or S3 object to another location locally or in S3.

mv

Moves a local file or S3 object to another location locally or in S3. The mv command copies the source object or file to the specified destination and then deletes the source object or file.

Options

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

Now, we need to install the AWS CLI.

After installation, check whether it is perfectly installed.

2. Making an Amazon AWS Account

For that make an account here and Fill the details and Sign in to the console.

3. Getting Access Keys
After signing in, go to https://console.aws.amazon.com/iam/ and click on Users.

4. Configuring the AWS CLI
Go to your terminal and type

5. Checking for vulnerable S3 Bucket

Now there are few commands/operations we can try on it.

Read File:

Due to misconfiguration, attacker can access the contents of the S3 bucket, which is very dangerous for sensitive content such as users’ personal data and documents. An attacker could extract all this data, potentially causing a data breach.

1. Obtain the S3 bucket URL: https://edumedias.s3.amazonaws.com

2. Access the URL in a web browser or using command-line tool AWS CLI.

Observe that the contents of the S3 bucket are accessible without requiring any authentication.

Command:

Request:

Response:

The impact of this vulnerability is severe and can result in the unauthorized disclosure of sensitive data.

By accessing the publicly exposed S3 bucket, an attacker could obtain and misuse confidential information, personally identifiable information (PII), and documents belonging to job seekers and employees.

Sensitive Data Exposed:

If the S3 bucket contains any sensitive content, never allow public access. Ensure that Block all public access is turned on.