TentyAll guides

Open storage buckets

A storage bucket holds the files of your app: uploads, images, exports. When the bucket lists its files to anyone, every file name is visible and every file can be downloaded.

What it is

Buckets on Amazon S3, Google Cloud Storage, DigitalOcean Spaces and Firebase Storage answer a plain web request for their file list when the bucket allows public listing. The bucket address ships in your page or scripts, so anyone who opens the browser tools can find it and ask for the list.

Why it matters

A public list turns a few shared images into the whole contents of the bucket. Invoices, contracts, database exports and backups sit next to the files you meant to share, and a list tells a visitor which ones to download. Tenty rates the finding critical when the first page of names looks like backups, data exports or credentials, and high otherwise.

How Tenty checks it

Tenty reads the files of your own site, collects the bucket addresses in them and sends one read-only request per bucket for the first 20 entries. This runs for verified owners only, with up to 10 buckets per scan. The finding names the bucket and the number of files on the first page. File names stay out of the report.

How to fix it

Turn off public listing and keep public reads for the files that need them.

  • Amazon S3: switch on Block Public Access for the bucket, then remove any bucket policy or ACL entry that gives s3:ListBucket to everyone. Serve public files through CloudFront or signed links.
  • Google Cloud Storage: remove allUsers and allAuthenticatedUsers from roles that include storage.objects.list, such as Storage Object Viewer. A custom role with only storage.objects.get lets visitors fetch a file when they know its address. Turn on public access prevention for buckets that hold private data.
  • DigitalOcean Spaces: open the bucket settings and choose Restrict File Listing.
  • Firebase Storage: in the storage rules, replace allow read: if true; with allow get: if true; allow list: if request.auth != null; for public files, or require sign in for the whole path.

After the change, run the reproduce command again and expect an access denied answer.

How to reproduce

Replace the address with the one in the finding.

curl -sS 'https://BUCKET.s3.amazonaws.com/?max-keys=20'

A list of <Key> entries means the bucket lists its files. Google Cloud Storage and Spaces answer the same way at their own addresses, and Firebase Storage answers with a JSON items list at /v0/b/BUCKET/o?maxResults=20.