Description

Detects AWS S3 buckets configured with dangerous HTTP methods enabled in CloudFormation templates. When dangerous HTTP methods (like DELETE, PUT) are enabled without proper restrictions, it can allow unauthorized users to modify or delete bucket contents, leading to data breaches or availability issues.

Detection Strategy

• Scan CloudFormation template files for S3 bucket resource definitions

• Check if bucket Properties include configurations that enable dangerous HTTP methods

• Report vulnerability if S3 bucket allows unrestricted use of dangerous HTTP methods like DELETE or PUT

• Focus on Properties section within AWS::S3::Bucket resource type declarations

Vulnerable code example

Resources:
  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      MethodSettings:
        - ResourcePath: "/*"   # Vulnerable: Allows access to all paths
          HttpMethod: "*"      # Vulnerable: Allows all HTTP methods
  MyBucket:...

✅ Secure code example

Resources:
  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      MethodSettings:
        - ResourcePath: "/*"
          HttpMethod: "GET"    # Restrict to only needed HTTP methods
          MetricsEnabled: true # Enable monitoring...