Anonymous access to private object storage
An unsigned request retrieves an object that the product promises to keep private.
Candidate CWE: CWE-732
Test hypothesis#
Create a tiny private canary through the intended workflow; confirm its contents with the owner identity. Request only its exact key anonymously, with a bounded range, and compare the private policy configuration. On GCP, inspect whether object ACLs remain active or uniform bucket-level access applies; on Azure, identify whether the observed request uses Entra, Shared Key, SAS or anonymous access.
Evidence required#
Object owner and privacy setting, unsigned request, exact marker, account/bucket identity and the intended authenticated control.
Rule out false positives#
Public website assets, intentional shared objects, a login page returned with status 200, or a policy candidate overridden by effective controls.
Playbook and command references#
- Object storage, signed URLs and delivery boundaries — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- Azure and GCP: identity, delegation and storage access — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1530 · Data from Cloud Storage — Only if: A demonstrated authorization or configuration failure permits collection of a controlled confidential object from an actual cloud storage service, including supported SaaS storage contexts. Not established by: A bucket name, public-by-design file, general BOLA, or any API response simply hosted in the cloud is insufficient. Establish the storage context and protected data boundary.