# Anonymous access to private object storage

An unsigned request retrieves an object that the product promises to keep private.

**Candidate CWE:** [CWE-732](https://cwe.mitre.org/data/definitions/732.html)

## Test hypothesis

Create a tiny private canary through the intended workflow; confirm its contents with the owner identity. Request only its exact key anonymously, with a bounded range, and compare the private policy configuration. On GCP, inspect whether object ACLs remain active or uniform bucket-level access applies; on Azure, identify whether the observed request uses Entra, Shared Key, SAS or anonymous access.

## Evidence required

Object owner and privacy setting, unsigned request, exact marker, account/bucket identity and the intended authenticated control.

## Rule out false positives

Public website assets, intentional shared objects, a login page returned with status 200, or a policy candidate overridden by effective controls.

## Playbook and command references

- [Object storage, signed URLs and delivery boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/storage-delivery.html) — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Object%20storage%2C%20signed%20URLs%20and%20delivery%20boundaries)

## Referenced by these target playbooks

[Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html) · [Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1530 · Data from Cloud Storage](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1530) — **Only if:** A demonstrated authorization or configuration failure permits collection of a controlled confidential object from an actual cloud storage service, including supported SaaS storage contexts. **Not established by:** A bucket name, public-by-design file, general BOLA, or any API response simply hosted in the cloud is insufficient. Establish the storage context and protected data boundary.

## Primary references

- [S3 public-access controls](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)
- [S3 GetObject CLI](https://docs.aws.amazon.com/cli/latest/reference/s3api/get-object.html)
- [Azure Blob management and data permissions](https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory)
- [GCP uniform bucket-level access](https://docs.cloud.google.com/storage/docs/uniform-bucket-level-access)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)