CVE-2025-27088
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability in oxyno-zeta/s3-proxy allows attackers to craft malicious URLs that inject scripts into the web application. When users visit these URLs, the scripts execute in their context, potentially leading to session hijacking or phishing attacks. All users of affected versions are at risk.
💻 Affected Systems
- oxyno-zeta/s3-proxy
📦 What is this software?
S3 Proxy by Oxyno Zeta
S3 Proxy by Oxyno Zeta
S3 Proxy by Oxyno Zeta
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal user sessions, perform actions as authenticated users, or redirect to phishing sites that appear legitimate due to the trusted domain context.
Likely Case
Session hijacking leading to unauthorized access to S3 resources, credential theft, or phishing attacks against users.
If Mitigated
Limited impact with proper input validation and output encoding, though the vulnerability still exists in the codebase.
🎯 Exploit Status
Exploitation requires only crafting malicious URLs with script payloads in the path parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.18.1
Vendor Advisory: https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjc
Restart Required: Yes
Instructions:
1. Stop the s3-proxy service. 2. Update to version 4.18.1 or later using your package manager or by downloading from GitHub. 3. Restart the service.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules to block malicious requests.
- Restrict access to the s3-proxy interface to trusted users only using network segmentation or authentication.
🔍 How to Verify
Check if Vulnerable:
Check if your s3-proxy version is below 4.18.1 by examining the binary or configuration.Check Version:
./s3-proxy --version or check the application logs for version informationVerify Fix Applied:
Confirm the installed version is 4.18.1 or higher and test that script injection in URL paths no longer executes.📡 Detection & Monitoring
Log Indicators:
- Unusual URL paths containing script tags or JavaScript code in access logs
- Multiple failed requests with suspicious path parameters
Network Indicators:
- HTTP requests with URL paths containing <script>, javascript:, or other XSS payloads
SIEM Query:
source="s3-proxy" AND (url="*<script>*" OR url="*javascript:*")🔗 References
- https://github.com/oxyno-zeta/s3-proxy/blob/master/templates/folder-list.tpl#L19C21-L19C38
- https://github.com/oxyno-zeta/s3-proxy/commit/c611c741ed4872ea3f46232be23bb830f96f9564
- https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjc
- https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjc
