Signed storage capability exceeds its authorized scope
The application issues or accepts a storage capability for an object, operation or lifetime beyond the caller's entitlement.
Candidate CWE: CWE-863
Test hypothesis#
Compare normal signing for A's fixture with signing for B's owned fixture. Separately compare the allowed method/key and the documented expiry case, changing one input at a time.
Evidence required#
A's identity, B's ownership, issuance request, capability scope, timestamps and successful canary operation. Redact the usable signature.
Rule out false positives#
A legitimately issued presigned URL works without the user's session, is reusable before expiry, or lasts within the explicitly documented sharing policy.
Playbook and command references#
- Object storage, signed URLs and delivery boundaries — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- Azure and GCP: identity, delegation and storage access — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1530 · Data from Cloud Storage — Only if: A demonstrated authorization or configuration failure permits collection of a controlled confidential object from an actual cloud storage service, including supported SaaS storage contexts. Not established by: A bucket name, public-by-design file, general BOLA, or any API response simply hosted in the cloud is insufficient. Establish the storage context and protected data boundary.