ibm-cloud-bucket-exposure: IBM Cloud Object Storage - Bucket Exposure

id: ibm-cloud-bucket-exposure

info:
  name: IBM Cloud Object Storage - Bucket Exposure
  author: 0x_Akoko
  severity: unknown
  description: |
    IBM Cloud Object Storage bucket is publicly accessible, potentially exposing sensitive files and data. Public bucket listing allows enumeration of stored objects.
  reference:
    - https://cloud.ibm.com/docs/cloud-object-storage
    - https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-bucket-permissions
  metadata:
    verified: true
    max-request: 2
    shodan-query: ssl.cert.subject.cn:"cloud-object-storage.appdomain.cloud"
    fofa-query: host="cloud-object-storage.appdomain.cloud"
  tags: ibm,cloud,bucket,exposure,misconfig,s3,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/?list-type=2"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<ListBucketResult", "<Name>")'
          - 'contains_any(tolower(header), "ibm-sse-kp-enabled", "ibm-sse-kp-customer-root-key-crn", "ibm-")'
          - 'contains_any(tolower(content_type), "application/xml", "text/xml")'
        condition: and

    extractors:
      - type: regex
        name: bucket-name
        part: body
        group: 1
        regex:
          - "<Name>([^<]+)</Name>"
# digest: 4b0a00483046022100a13275a0c5cb277b92ea8eea8770f71e3956458c5396d7ba484061599de130da022100d80d4ac4f525122f30387cfefa17bd8189478ed0566161786bcacbaa8b696ce4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.