Web Hack List

Preliminary research

Path traversal in signed URLs — present even in the official AWS SDKs

AWS公式SDKにも存在した、署名付きURLにおけるパストラバーサル

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

S3 keys are flat, so ../ in an object key is only text until something normalises the path while a presigned URL is built. AWS SDK for Go v1 runs path.Clean() after filling /{Bucket}/{Key+}, so a key of ../other-bucket/secret.txt signs a URL for a different bucket, while @aws-sdk/cloudfront-signer normalised through new URL(). The same trap reaches application code through path.normalize, path.join and URL construction before signing.

Record

Document
AWS公式SDKにも存在した、署名付きURLにおけるパストラバーサル
Researcher
Matsui and Eui Chul Chung
Published by
GMO Flatt Security Blog
Date
Topic
Server

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of Matsui and Eui Chul Chung, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .