# Unauthorized object creation or replacement

An unauthorized principal can create or replace an object in a protected storage location.

**Candidate CWE:** [CWE-732](https://cwe.mitre.org/data/definitions/732.html)

## Test hypothesis

Reserve a disposable key with the owner, record its initial marker/version, then attempt one inert write as the disallowed fixture identity. Have the owner confirm the resulting bytes and clean up every fixture version.

## Evidence required

Protected prefix/key rule, writer identity, accepted write request, owner-confirmed marker/version and secure comparison.

## Rule out false positives

Intentionally anonymous uploads confined to a quarantine area, a returned upload URL that cannot write, or writing only to the caller's allowed prefix.

## Playbook and command references

- [Object storage, signed URLs and delivery boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/storage-delivery.html) — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Object%20storage%2C%20signed%20URLs%20and%20delivery%20boundaries)

## Referenced by these target playbooks

[Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html) · [Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [S3 public-access controls](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)
- [S3 signed upload/download behavior](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)