Preliminary research
Path traversal in signed URLs — present even in the official AWS SDKs
AWS公式SDKにも存在した、署名付きURLにおけるパストラバーサル
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
S3 keys are flat, so ../ in an object key is only text until something normalises the path while a presigned URL is built. AWS SDK for Go v1 runs path.Clean() after filling /{Bucket}/{Key+}, so a key of ../other-bucket/secret.txt signs a URL for a different bucket, while @aws-sdk/cloudfront-signer normalised through new URL(). The same trap reaches application code through path.normalize, path.join and URL construction before signing.
Record
- Document
- AWS公式SDKにも存在した、署名付きURLにおけるパストラバーサル
- Researcher
- Matsui and Eui Chul Chung
- Published by
- GMO Flatt Security Blog
- Date
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Matsui and Eui Chul Chung, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .