S3 Bucket Takeover vulnerability

[nvk0x]

Description

I found an unclaimed s3 bucket was using in file, I claimed the bucket and uploaded poc.

Steps to Reproduce:

1. Go to this link to check code
2. S3 bucket name: s3.amazonaws.com/navpi-image is using in index.md file

3. Click here for POC: https://s3.amazonaws.com/navpi-image/index.html

Fix:

Please remove this S3 bucket from the code or tell me i will delete this bucket from my aws account and claim it.

Impact:

• Attacker can get navcoin employees private IPs Whenever navcoin developers run this project
• Attacker can host malicious content on this bucket

[nvk0x]

Hi,

Any update ?
I am removing S3 bucket: s3.amazonaws.com/navpi-image from my aws account, it's costing me