Misconfigured S3 Bucket

Overview

AWS S3 buckets are a widely used cloud storage service. S3 exposes two primary attack surfaces: HTTP and the S3 protocol. While most content will be accessed over HTTP, it is most important to verify bucket and object permissions via S3 itself. Below is a list of permissions which may be set on a bucket:

S3 Permission List
s3:GetBucketAcl
s3:GetBucketCORS
s3:GetLifecycleConfiguration
s3:GetBucketNotification
s3:GetBucketPolicy
s3:GetBucketTagging
s3:GetBucketWebsite
s3:PutBucketCORS
s3:PutLifecycleConfiguration
s3:PutBucketLogging
s3:PutBucketNotification
s3:PutBucketTagging
s3:PutBucketWebsite
s3:PutObject
s3:PutBucketAcl
s3:PutBucketPolicy

S3 in Penetration Testing

A traditional penetration test will often cover an application’s attack surface over HTTP, however may omit proprietary S3 test cases unless the assessor is well versed in AWS security.

Virtue Security has provided a free open source utility and Burpsuite extension to assess the security of S3 buckets. It is recommended this be used by testers when assessing applications which host content in S3 buckets.

Remediation

Virtue Security recommends that the access control list (ACL) be set to only allow full control for the bucket owner. This can be achieved by using the “private” canned ACL.

Regular reviews should be performed to ensure that proper permissions are set on all buckets. Care should be taken to ensure that excessive permissions are not granted to “authenticated users” which includes all authenticated users of the AWS platform.

References: http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html