Amazon S3 publicly writable bucket
Description
Amazon S3 (Simple Storage Service) organizes files into buckets, which are containers accessible via predictable URLs. Each bucket and its objects can have access controls to restrict who can read, write, or delete content.
This vulnerability occurs when an S3 bucket used by the application is configured with public write permissions. This misconfiguration allows any unauthenticated user on the internet to upload new files, modify existing content, or delete objects within the bucket, potentially compromising the integrity and availability of application resources.
Remediation
Immediately restrict write access to the affected S3 bucket by following these steps:<br/><br/>1. <strong>Review and update bucket ACLs:</strong><br/>- Navigate to the AWS S3 Console and select the affected bucket<br/>- Go to the "Permissions" tab and review the Access Control List (ACL)<br/>- Remove any grants that provide WRITE or FULL_CONTROL permissions to "Everyone" or "Authenticated Users"<br/><br/>2. <strong>Configure bucket policies:</strong><br/>- Use bucket policies to explicitly deny public write access<br/>- Example policy to prevent public writes:<br/><pre> { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyPublicWrite", "Effect": "Deny", "Principal": "*", "Action": [ "s3:PutObject", "s3:DeleteObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*", "Condition": { "StringNotEquals": { "aws:PrincipalAccount": "YOUR-ACCOUNT-ID" } } } ] } </pre><br/>3. <strong>Enable Block Public Access settings:</strong><br/>- In the bucket's "Permissions" tab, enable "Block all public access" unless specific public read access is required<br/><br/>4. <strong>Audit existing objects:</strong><br/>- Review all objects in the bucket for unauthorized modifications or uploads<br/>- Remove any suspicious or unauthorized files<br/><br/>5. <strong>Implement least privilege access:</strong><br/>- Grant write permissions only to specific IAM users, roles, or services that require them<br/>- Use IAM policies rather than bucket ACLs for more granular control