Universal Cloud Bucket Hijacking for Data Exfiltration

Researchers have uncovered a fundamental architectural vulnerability across major Cloud Service Providers (CSPs), including AWS, Google Cloud, and Microsoft Azure, stemming from the global uniqueness of storage bucket names. This 'Universal Bucket Hijacking' technique allows an attacker with sufficient permissions to delete a target bucket and immediately recreate it in their own environment. Because cloud data streams (like logging sinks or replication rules) often resolve destinations by name rather than immutable account IDs, the traffic is silently rerouted to the attacker.

Technical simulations successfully demonstrated data exfiltration via Google Cloud Logging, Pub/Sub, Storage Transfer Service, AWS S3 Replication, and Amazon Data Firehose. While Azure's implementation is restricted to cross-subscription hijacking within a single tenant due to name-reuse delays, the overall risk remains high across the cloud ecosystem. This attack is particularly insidious because the 'router' or 'sink' configuration appears valid and operational in the victim's console even after the destination has been hijacked.

This research highlights a significant risk associated with over-privileged administrative roles, specifically those granting 'delete' permissions for storage resources. If an attacker gains these privileges, they can bypass more granular 'update' permissions required to change a data stream's destination, effectively achieving the same exfiltration result through bucket replacement.