S3ã®ãƒ¡ã‚¿ãƒ‡ãƒ¼ã‚¿ã‚’用ã„ãŸæ”»æ’ƒä¾‹ãˆã°ã€Content-Typeメタデータã®å€¤ã‚’ç´°å·¥ã—ãŸã‚ªãƒ–ジェクトをå–å¾—ã•ã›ã‚‹ã“ã¨ã§XSSを発生ã•ã›ãŸã‚Šã€Content-Dispositionメタデータを細工ã—ã¦RFD (Reflected File Download) を引ãèµ·ã“ã—ãŸã‚Šã€ x-amz-storage-classメタデータをæ“作ã—ã¦æ„図ã›ã¬ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ã‚¯ãƒ©ã‚¹ã‚’使用ã•ã›EDoS (Economical Deninal of Sustainability)を発生ã•ã›ãŸã‚Šã€ã¨ã„ã£ãŸæ”»æ’ƒãŒæˆç«‹ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ä¸ã§ã‚‚Content-Typeを悪用ã—ãŸXSSã¯ã€S3ã®ä»•æ§˜ã‚„使用方法ã ã‘ã§ãªãã€ãƒ–ラウザã®æŒ™å‹•ã«ã‚‚注æ„を払ã†å¿…è¦ãŒã‚ã‚Šã€ã‚¢ãƒ—リ開発者ã¯æ”»æ’ƒã®åŽŸç†ã¨å¯¾å‡¦ã‚’ç†è§£ã—ã¦ãŠãå¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ 9/21ã«Azaraã•ã‚“ã¨Security-JAWSã®ã‚³ãƒ©ãƒœã§ã€ã“ã®å•é¡Œã«ãƒ•ã‚©ãƒ¼ã‚«ã‚¹ã—ãŸCTFイベント「ã¨ã‚ã‚‹æµ·è±¹ã¨Security-
Amazon S3ã®å¤§è¦æ¨¡éšœå®³ã¯äººç‚ºçš„ミスãŒåŽŸå› 
EC2ã‹ã‚‰NFS経由ã§S3オブジェクトをä¿ç®¡ã§ãるよã†ã«ãªã‚Šã¾ã—ãŸï¼[Storage Gateway] | DevelopersIO![EC2ã‹ã‚‰NFS経由ã§S3オブジェクトをä¿ç®¡ã§ãるよã†ã«ãªã‚Šã¾ã—ãŸï¼[Storage Gateway] | DevelopersIO](https://cdn-ak-scissors.b.st-hatena.com/image/square/5cef8c014e947c6d69a900c17c28496da9c46366/height=288;version=1;width=512/https%3A%2F%2Fdevio2023-media.developers.io%2Fwp-content%2Fuploads%2F2014%2F05%2FAWS_Storage_Gateway.png)
S3 + Lambda + Cognitoを使ã£ã¦ã€ç°¡å˜ãŠå•ã„åˆã‚ã›ã‚·ã‚¹ãƒ†ãƒ 構築 - Qiita
s3fsã®ä½•ãŒæ‚ªã„ã®ã‹ï¼Ÿ - プãƒã‚°ãƒ©ãƒžã§ã‚ã‚ŠãŸã„
Rubyã®AWS::S3を使ã£ã¦S3ã®æ±äº¬ãƒªãƒ¼ã‚¸ãƒ§ãƒ³ã«ãƒ•ã‚¡ã‚¤ãƒ«å‡ºæ¥ãªã„å ´åˆã®å¯¾å‡¦æ³•ï¼ï¼ - Qiita
{{#tags}}- {{label}}
{{/tags}}