S3 Bucket Misconfiguration Bug Bounty: Public Cloud Storage Finds
Public buckets keep paying because someone always leaves a backup, mobile build, or “temporary” export world-readable. You do not need AWS credentials to start. You need names in scope and careful handling of other people’s files.
Where names come from
- JS and mobile strings:
*.s3.amazonaws.com,s3., Cloudflare R2, GCSstorage.googleapis.com - Error messages and email templates
- Certificate and subdomain recon (
assets-company,static-prod) - Program asset lists
Stick to in-scope company naming. Guessing random global buckets is noisy and often out of policy.
Checks that stay ethical
- HEAD/GET the bucket root or a known public object path.
- See if listing is enabled (
ListBucket). - See if unauthenticated PUT/POST/DELETE works on a harmless test object you create — never overwrite their files.
- Stop. Screenshot policy / ACL evidence. Do not bulk-download PII to “prove impact.”
Writable + listable on a production assets bucket is usually enough with a tiny proof object named something obvious like bugflare-poc.txt.
Impact framing
- Source maps and
.envbackups → secret exposure - Customer exports → privacy incident class
- Overwritable static JS → stored XSS / supply-chain vibe on the site that hosts that bucket
- Build artifacts → internal endpoints and keys
Match severity to data class. An empty public marketing bucket may be informational.
Common “not a bug” replies
Public by design CDN buckets for blog images. Your job is to show sensitive objects or write access. If everything visible is meant to be public, say so and move on.
Remediation blurb
Block public ACLs at the org level (AWS Block Public Access). Use CloudFront/OAI or signed URLs for private objects. Separate public asset accounts from data lakes. Alert on policy changes.
I once found a “thumbs” bucket that also held CSV exports because a job reused the same prefix. Listing was the only “exploit.” The report was still high — sensitivity beats cleverness.
Cloud storage misconfig is recon plus restraint. Name the bucket, prove the ACL, leave their data alone.