Alibaba Cloud OSS
Alibaba Cloud Object Storage Service (OSS) hosts buckets at `<bucket>.oss-<region>.aliyuncs.com`. The S3-style ACL model is in use, with `public-read` and `public-read-write` presets in the console.
Alibaba Cloud OSS exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
OSS bucket creation flows in the Chinese-language console default to surfacing "public-read" prominently, leading to copy-paste of that ACL into production. Cross-region replication then propagates the misconfig.
Real-world impact
Public ACL exposes both the object list and contents. Many CN-region exposures contain trade-secret datasets and Big Data exports.
Remediation
- Set bucket ACL to `private` and rely on STS-issued temporary credentials.
- Enable OSS Bucket Inventory to audit object-level grants periodically.
URL patterns
Alibaba Cloud OSS buckets typically resolve under hostnames like:
example.oss-cn-hangzhou.aliyuncs.comexample.oss-ap-southeast-1.aliyuncs.com
Check a specific Alibaba Cloud OSS URL
Paste any Alibaba Cloud OSS URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Alibaba Cloud OSS bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request