While I prefer more to write/talk about far-going topics instead of just one vulnerability write-up, I decided to make an exception for this one because it was definitely an original one.
On the both document upload and document view sections, I found out that the application is using Amazon AWS as CDN for storing & gathering these uploaded documents. For the view of the document, the request was like on the below:
So the application was sending a request to the
/s3/preSignedURL endpoint with some parameters such as a payload to define the exact file and an operation name.
For the ones who are not familiar with the technology, AWS has a signing technology which is used on demand, which ensures that access to the sensitive documents are not possible via malicious third parties. These signatures are generated on the back-end with some private information such as AWS secret keys.
If you are more interested about this signing technology, you can check it our via: https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
/s3/preSignedURL endpoint was used for gathered the signed URL’s on the AWS storage for viewing documents. URL encoded
payload parameter was having the value below:
And on the response, the
url parameter was generated with the syntax:
https://target.attachments.s3.amazonaws.com/<S3TmpKey>?Signatures. How to proceed next?
Well, on all of my testing, I prefer to send requests which are clean and basic all the time for a better understanding, and if the response returns error then add the other parameters one by one to check the behavior on the back-end to see what is that used for. For this one, I deleted all parameters except
S3TmpKey which value was equals to my documents path/name and I also deleted that parameters value and send it empty.
S3TmpKey parameter empty returned the valid signing for the S3 buckets root directory.
Direct access to the URL parameter from browser returned directory listing for all documents names and their exact paths!
S3TmpKey parameter to these paths/filenames to other users, it was possible to gather all documents under this S3 bucket!
This discovery brought me around 1k payout after 4 or 5 hours of my submission (Thanks to 24 hour rule of Synack) and the client fixed it within a week due to the criticality of it.