alibaba-bucket-listing: Alibaba Cloud OSS Bucket - Public Listing Enabled

id: alibaba-bucket-listing

info:
  name: Alibaba Cloud OSS Bucket - Public Listing Enabled
  author: 0x_Akoko
  severity: unknown
  description: |
    Alibaba Cloud Object Storage Service (OSS) bucket is publicly accessible and allows anonymous listing of objects. This misconfiguration can expose sensitive data, lead to data breaches, and result in unexpected charges on the Alibaba Cloud bill.
  reference:
    - https://www.alibabacloud.com/help/en/oss/user-guide/block-public-access
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-OSS/publicly-accessible-oss-bucket.html
  metadata:
    verified: true
    max-request: 1
    google-query: site:aliyuncs.com "ListBucketResult" "<Contents>"
  tags: alibaba,cloud,bucket,misconfig,exposure,devops,cicd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/xml")'
          - 'contains(header, "AliyunOSS")'
          - 'contains_all(body, "<ListBucketResult", "<Name>", "<Contents>", "<Key>")'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '<Name>([^<]+)</Name>'
# digest: 4a0a00473045022003b0720eee60f258134649c88f1710ba250b46c282639b937164baf3539f7c3f022100cd6e0e9a2b1f2d4e615bf84af32c104103e8331cc3c9d007b007d5d21bcc0cec:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.