domains / families / security / s3-minio-content-type-xss

s3-minio-content-type-xss

separate

Exploit public bucket Content-Type override for stored XSS on target origin.

When to use

• Target serves user-uploaded files (images, avatars, attachments) from a public bucket.
• Files are served under the target's own domain or subdomain (not a random storage domain).
• Upload validation appears solid (extension whitelist, magic byte check, forced Content-Type) — the override bypasses all of these at serve time, not upload time.
• The bucket URL responds to `?response-content-type=` with a changed Content-Type.
• The bucket returns an AWS SignatureDoesNotMatch error leaking the real bucket host and region.

When not to use

• Cross-origin buckets with low impact

Skill page

Source