Check ID: objectstorage_container_listing_disabled
Provider: OpenStack
Service: objectstorage
Severity: MEDIUM
Categories: internet-exposed
Resource type: OS::Swift::Container

​
What this check verifies

OpenStack Swift containers are evaluated to verify that public container listings are disabled. The .rlistings ACL allows users with read access to list all objects within the container. When combined with .r:*, this enables unauthenticated users to enumerate all objects, facilitating targeted data exfiltration.

​
Risk

Containers with .rlistings enabled allow attackers to enumerate all object names, sizes, and modification dates. This metadata exposure aids targeted attacks, reveals application structure, and can expose sensitive file names. Combined with public read access, it enables complete data exfiltration.

​
Recommendation

Remove .rlistings from container read ACLs to prevent public object enumeration. Listings should only be available to authenticated project members. If external access is needed, implement application-level access control with authenticated APIs.

​
Remediation

swift post <container_name> —read-acl ”

​
References

​
Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_container_listing_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to OpenStack checks