S3 Is A Security Nightmare (Common Exploit Showcase)
Source: YouTube · Theo - t3․gg · published Jun 17, 2024 · 16:49
This video explores common AWS S3 security vulnerabilities, specifically focusing on how misconfigured pre-signed post URLs and file uploads can lead to severe exploits like cross-site scripting (XSS) and data overwrites 0:00.
Key Takeaways:
• Developers often use pre-signed post URLs to let users upload directly to S3, skipping their servers to reduce latency and costs, but this creates security risks if not implemented correctly 4:01-4:07.
• Storing files on subdomains like files.company.com often allows XSS attacks if cookies are misconfigured, as malicious HTML or SVG files uploaded by users can access session cookies from the main domain 5:23-5:28.
• The video demonstrates a real-world exploit on the platform Tally, where an attacker used an SVG file with an XML namespace to bypass sanitization and execute JavaScript, stealing user credentials via a refresh token endpoint 8:52-9:05.
• Another common vulnerability allows users to control the S3 file key during upload, enabling them to overwrite files belonging to other users, which was successfully demonstrated on the donation platform P 11:12-11:23.
To mitigate these risks, developers should ensure proper cookie settings, generate file keys server-side to prevent overwrites, or utilize managed file upload services 15:44-15:50.
Sources:
- 0:00 Introduction to S3 security issues
- 4:01-4:07 Explanation of pre-signed post URLs
- 5:23-5:28 Cookie misconfiguration and XSS risks
- 8:52-9:05(https://www.youtube.com/watch?v=9UC5_Wfg9TI&
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I wanted to do a video about the security issues with S3 for a while if you're using it yourself right now there's a good chance you've made some configuration issues that could cause some massive security flaws in February I found this blog post and I immediately added it to my to-do for video content because I want to talk about S3 and all the things people do wrong with it and how easy it is to find like an account ID since then though Our Community member Eva has done a lot of crazy with S3 and other people's implementations on top of it and honestly this is a much much better post and a much better video and I can't not take the opportunity to read it and share with you guys the hack and the craziness that is how badly most people set up and secure their S3 if you recognize this blog …