Status: ready
S3 bucket: a2-pdf-bucket-andy
S3 key: uploads/1779799461_3888b7cf251d4863a53d8c63780e00c0_part-b-finding-s3-bucket.pdf
Uploaded: 2026-05-26 12:44:21.269503+00:00
| Strategy | Status | Chunks | Average length | Processing time | Error |
|---|---|---|---|---|---|
| Fixed-size chunking | completed | 18 | 964.3 | 0.643 sec | |
| Paragraph-aware chunking | completed | 17 | 820.9 | 0.640 sec |
Chunk 0 - 1000 characters
# Page 1 Part B — Highest-Impact Finding: S3 Bucket Public Directory Listing Note: Part B has no separate written report per the spec. This document serves as the preparation and evidence base for the recorded presentation and Q&A defense. 1. Target Field Value Program Banco Plata (HackerOne Bug Bounty, Gold Standard) Program URL https://hackerone.com/banco_plata Asset prime.platacard.mx Endpoint https://prime.platacard.mx/file- service/static/ Infrastructure AWS S3 bucket platform-file-service- manager-prod-public behind CloudFront Scope *.platacard.mx — in-scope per program policy (Open Scope) 2. Vulnerability Classification Field Value CWE CWE-548: Exposure of Information Through Directory Listing OWASP A05:2021 – Security Misconfiguration CVSS 4.0 5.3 (Medium) — AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N # Page 2 Field Value Normalized Severity S2 (...
Chunk 1 - 1000 characters
4.0 5.3 (Medium) — AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N # Page 2 Field Value Normalized Severity S2 (Medium) CVSS Vector Breakdown Metric Value Justification Attack Vector (AV) Network Accessible via public internet Attack Complexity (AC) Low Simply visiting a URL Privileges Required (PR) None No authentication needed User Interaction (UI) None No user interaction required Confidentiality (C) Low Internal documents and financial reports exposed Integrity (I) None Read-only, no write access Availability (A) None No disruption to service Root Cause The S3 bucket platform-file-service-manager-prod-public has public directory listing enabled (ListObjects permission granted to *). When a GET request is made to the root path without a specific object key, S3 returns an XML enumeration of all stored objects. The bucket is proxied through prime.platacard.mx/file- service/stat...
Chunk 0 - 861 characters
# Page 1 Part B — Highest-Impact Finding: S3 Bucket Public Directory Listing Note: Part B has no separate written report per the spec. This document serves as the preparation and evidence base for the recorded presentation and Q&A defense. 1. Target Field Value Program Banco Plata (HackerOne Bug Bounty, Gold Standard) Program URL https://hackerone.com/banco_plata Asset prime.platacard.mx Endpoint https://prime.platacard.mx/file- service/static/ Infrastructure AWS S3 bucket platform-file-service- manager-prod-public behind CloudFront Scope *.platacard.mx — in-scope per program policy (Open Scope) 2. Vulnerability Classification Field Value CWE CWE-548: Exposure of Information Through Directory Listing OWASP A05:2021 – Security Misconfiguration CVSS 4.0 5.3 (Medium) — AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N # Page 2
Chunk 1 - 1390 characters
Field Value Normalized Severity S2 (Medium) CVSS Vector Breakdown Metric Value Justification Attack Vector (AV) Network Accessible via public internet Attack Complexity (AC) Low Simply visiting a URL Privileges Required (PR) None No authentication needed User Interaction (UI) None No user interaction required Confidentiality (C) Low Internal documents and financial reports exposed Integrity (I) None Read-only, no write access Availability (A) None No disruption to service Root Cause The S3 bucket platform-file-service-manager-prod-public has public directory listing enabled (ListObjects permission granted to *). When a GET request is made to the root path without a specific object key, S3 returns an XML enumeration of all stored objects. The bucket is proxied through prime.platacard.mx/file- service/static/ without any access control layer. Steps to Reproduce 1...