other

CTL.S3.BUCKET.TAKEOVER.001

Stave control titled Referenced S3 Buckets Must Exist And Be Owned, which evaluates DNS references to S3 endpoints instead of the buckets themselves and fires when the referenced bucket is missing or unowned.

Known aliases

Referenced S3 Buckets Must Exist And Be Owned

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

A CNAME left pointing at a deleted S3 bucket hands the subdomain to whoever registers the name first

In HackerOne 121461 a researcher created the missing bucket in their own AWS account and served files on a2.bime.io. The state that allowed it is a name sitting in the DNS zone with no matching bucket in the account.

Publishers:dev.to

Reality

Evidence55
Adoption: Insufficient
Hype gap+30
Incentives85
Confidence60