S3/MinIO Content-Type Override to Stored XSS

Exploit public cloud storage buckets (S3, MinIO, and compatible) by overriding the Content-Type response header via query parameters. When a target serves user-uploaded files from its own origin (e.g., cdn.target.com or target.com/uploads/), a successful override turns a stored HTML/JS payload into same-origin stored XSS — bypassing every upload-time validation the application performed.

When to Use

• Target serves user-uploaded files (images, avatars, attachments) from a public bucket.
• Files are served under the target's own domain or subdomain (not a random storage domain).
• Upload validation appears solid (extension whitelist, magic byte check, forced Content-Type) — the override bypasses all of these at serve time, not upload time.
• The bucket URL responds to ?response-content-type= with a changed Content-Type.
• The bucket returns an AWS SignatureDoesNotMatch error leaking the real bucket host and region.

Prerequisites

• terminal with curl and python3.
• Identify at least one public object URL served from storage.
• For S3 exploitation: your own AWS account credentials (free tier sufficient).

Quick Detection