Mail.ru: [my.games] Stored XSS via untrusted bucket

Domain, site, application

https://my.games/

Details

If you check page source of https://my.games, you can notice that site gets static files (scripts, styles, images) using following URL declaration:
https://my.games/hotbox/mygames/frontend/v3-6-13/img/share/main.png

mygames here is a name of S3 bucket.
After creating own S3 bucket in AWS and using https://my.games/hotbox/BUCKET_NAME/, I got “NoSuchBucket” error.

But my comrade investigated, that hotbox is one of the available types of S3 bucket in MCS.

…

Preconditions

1. Create your S3 bucket at https://mcs.mail.ru/app/services/storage/buckets/.
2. Upload any malicious file (e.g. HTML page).
3. Make this file public.

Steps to reproduce

1. Open following link in browser:
   https://my.games/hotbox/YOUR_BUCKET_NAME/YOUR_FILE_NAME

PoC, exploit code, screenshots, video, references, additional resources

https://my.games/hotbox/foobar1337/oops.html
{F828044}

Impact

An attacker can host any malicious file on my.games domain.