Ddd

An authorization bypass allows any authenticated low-privilege user with read access to a repository to push arbitrary commits directly to that repository, bypassing write-access checks. This occurs when the "Allow edits from maintainers" pull request (PR) option is abused through reverse-fork PRs. Specifically, the PR-create endpoint fails to verify if the submitter has write access to the HEAD repository when `allow maintainer edit=true` is set. By creating a PR where the BASE is the attacker's fork and the HEAD is the upstream target, the attacker can leverage their maintainer status on the BASE repository to authorize pushes to the upstream target via the `CanMaintainerWriteToBranch()` function in `models/issues/pull list.go`. This can lead to full repository compromise, enabling users to backdoor any repository they can read, including public ones.

An authentication bypass exists in the `STREAMING-UNSIGNED-PAYLOAD-TRAILER` code path. An attacker possessing a valid access key can write arbitrary objects to any bucket without a secret key or a valid cryptographic signature. The issue occurs because `PutObjectHandler` and `PutObjectPartHandler` utilize `newUnsignedV4ChunkedReader` with a signature verification gate that relies only on the `Authorization` header. Simultaneously, `isPutActionAllowed` accepts credentials from either the `Authorization` header or the `X-Amz-Credential` query parameter. By omitting the `Authorization` header and providing credentials via the query string, the signature gate is bypassed, and the request is processed using the permissions of the impersonated access key. This affects standard and tables/warehouse bucket paths as well as multipart uploads.

An authentication bypass exists in the Snowball auto-extract handler `PutObjectExtractHandler`. This issue allows a user with a valid access key to write arbitrary objects to any bucket without providing a secret key or a valid cryptographic signature. The flaw occurs because the `switch rAuthType` block in the handler lacks a case for `authTypeStreamingUnsignedTrailer`, causing execution to bypass signature verification. An attacker can exploit this by sending a PUT request with the header `X-Amz-Content-Sha256` set to `STREAMING-UNSIGNED-PAYLOAD-TRAILER`, the header `X-Amz-Meta-Snowball-Auto-Extract` set to `true`, and an `Authorization` header containing a valid access key with a fabricated signature.