# Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket

CloudFront for rubygems.org pointed at an unclaimed S3 bucket index.rubygems.org, letting the researcher claim it and serve cached HTML/XSS and forged gem checksums.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: p4fg
- Disclosed: 2023-12-07
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2262939
- Library page: https://bugbountylibrary.com/r/h1%3A2262939
- Tags: area:cloud domain:cloud impact:ato impact:integrity kind:bounty platform:hackerone sev:medium tech:aws tech:cdn technique:recon vuln:misconfiguration vuln:subdomain-takeover vuln:xss

**Target:** AWS CloudFront distribution / S3 origin bucket (index.rubygems.org)
**Root cause:** CloudFront origin referenced an S3 bucket name that was never registered, and the distribution used the wrong region (us-west-2 vs us-east-2), so anyone could claim the bucket and control origin content.
**Steps:**
1. Request `https://rubygems.org/names`; observe S3 `NoSuchBucket` error naming `index.rubygems.org`.
2. Create bucket `index.rubygems.org` in us-east-2; request again and observe `TemporaryRedirect` to `index.rubygems.org.s3.us-east-2.amazonaws.com`, revealing region mismatch.
3. Recreate the bucket in us-west-2 and upload a file named `names` with `Content-Type: text/html`.
4. Request `https://rubygems.org/names`; CloudFront serves attacker content and caches it.
**How found:** Stumbled on `https://rubygems.org/names` returning an S3 NoSuchBucket error, then iteratively claimed the bucket in different regions to confirm the CloudFront origin misconfiguration.
**Exploitation:** Attacker claims the dangling bucket, uploads files matching expected paths (e.g. `names`, `/info/<gem>`) with attacker-chosen content-type, and CloudFront caches and serves them from rubygems.org, enabling stored XSS against logged-in maintainers and forged gem checksums for supply-chain attacks.
**Escalation:** Content-type control yields stored XSS on rubygems.org; control of `/info/*` checksum endpoints could enable supply-chain manipulation; availability impact on CI pipelines and Artifactory clients.
**Insight:** S3 error responses leaking the bucket name and region are a direct signal of a dangling origin; try claiming the bucket in each region to detect CloudFront origin region mismatches.