Back to Checks
openstack

Object storage container listings are not publicly accessible

objectstorage_container_listing_disabled
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:OS::Swift::Container

OpenStack Swift containers are evaluated to verify that public container listings are disabled. The .rlistings ACL allows users with read access to list all objects within the container. When combined with .r:*, this enables unauthenticated users to enumerate all objects, facilitating targeted data exfiltration.

Prowler logoProwlerprowler-provider-openstack

Risk

Containers with .rlistings enabled allow attackers to enumerate all object names, sizes, and modification dates. This metadata exposure aids targeted attacks, reveals application structure, and can expose sensitive file names. Combined with public read access, it enables complete data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks objectstorage_container_listing_disabled

Recommendation

Remove .rlistings from container read ACLs to prevent public object enumeration. Listings should only be available to authenticated project members. If external access is needed, implement application-level access control with authenticated APIs.

Remediation

CLI

swift post <container_name> --read-acl ''

Other

1Navigate to **Object Store > Containers**
2Select the container with public listing
3Edit the container metadata
4Remove `.rlistings` from the Read ACL
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_container_listing_disabled(Check):
    """Ensure object storage container object listings are not publicly accessible."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for container in objectstorage_client.containers:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=container)
            acl_entries = [entry.strip() for entry in container.read_ACL.split(",")]
            if ".rlistings" in acl_entries:
                report.status = "FAIL"
                report.status_extended = f"Container {container.name} has public listing enabled (.rlistings) allowing anonymous object enumeration."
            elif "*:*" in acl_entries or "*" in acl_entries:
                report.status = "FAIL"
                report.status_extended = f"Container {container.name} has listing enabled via global read ACL (*:*) allowing all authenticated users to list objects."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Container {container.name} does not have public listing enabled."
                )

            findings.append(report)

        return findings

References