s3-minio-content-type-xss

1# S3/MinIO Content-Type Override to Stored XSS
2 
3Exploit public cloud storage buckets (S3, MinIO, and compatible) by overriding the `Content-Type` response header via query parameters. When a target serves user-uploaded files from its own origin (e.g., `cdn.target.com` or `target.com/uploads/`), a successful override turns a stored HTML/JS payload into same-origin stored XSS — bypassing every upload-time validation the application performed.
4 
5## When to Use
6 
7- Target serves user-uploaded files (images, avatars, attachments) from a public bucket.
8- Files are served under the target's own domain or subdomain (not a random storage domain).
9- Upload validation appears solid (extension whitelist, magic byte check, forced Content-Type) — the override bypasses all of these at serve time, not upload time.
10- The bucket URL responds to `?response-content-type=` with a changed Content-Type.
11- The bucket returns an AWS SignatureDoesNotMatch error leaking the real bucket host and region.
12 
13## Prerequisites
14 
15- `terminal` with curl and python3.
16- Identify at least one public object URL served from storage.
17- For S3 exploitation: your own AWS account credentials (free tier sufficient).
18 
19## How to Run
20 
21```bash
22# Test if an object's Content-Type can be overridden (MinIO and compatible)
23curl --max-time 30 --connect-timeout 10 -skI "https://cdn.target.com/uploads/avatar123.png?response-content-type=text/html" | grep -i content-type
24…