The vulnerability in oxyno-zeta/s3-proxy (versions before 5.0.0) is caused by a mismatch in how the authentication middleware and the bucket handler interpret URL paths. The authentication middleware checks resource paths against the percent-encoded request URI, while the bucket handler uses the decoded path. This discrepancy, combined with the glob library's behavior allowing '*' to match across path separators, enables path traversal attacks. Attackers can exploit this by using patterns that traverse directories (e.g., '../'), percent-encoded slashes (%2F), or glob patterns to access or modify protected S3 object namespaces without authentication. This leads to unauthorized read, write, or delete operations on S3 objects. The vulnerability is resolved in version 5.0.0.

An unauthenticated attacker with network access can bypass authentication controls and perform unauthorized operations (PUT, GET, DELETE) on objects within authentication-protected S3 namespaces. This compromises confidentiality and integrity of stored data and may cause limited availability impact. The CVSS score of 9.4 reflects critical impact on confidentiality and integrity with low attack complexity and no required privileges.

A fixed version (5.0.0) of oxyno-zeta/s3-proxy is available that resolves this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance is updated to version 5.0.0 or later to ensure protection against this vulnerability. Patch status is confirmed by the vendor's release of version 5.0.0.