Subdomain Takeover via netlify

[m7mdharoun]

netlify

https://medium.com/@alirazzaq/subdomain-takeover-worth-200-ed73f0a58ffe

Documentation

[AnotherWayIn]

when you attempt to add a custom domain on Netlify, they ask you to add a randomly-named cname record for them to verify. Because of this, it doesn't look like you can do takeovers anymore. Unless i've missed a trick?

[codingo]

@AnotherWayIn How random is the seed? Have you done collision checks on it?

I've managed to do takeovers on some services by looping the creation/deletion of a service with a random seed until I hit a collision for an old service either using javascript in a client session or looping in python/bash utilizing something like the AWS cli.

[codingo]

Also this seems more remote as it's a change from the old state, so I'm going to flag this as not vulnerable unless confirmed otherwise.

[AnotherWayIn]

Yeah, BF is not possible here. Mine for example is asking for the cname to be:
gallant-pare-4f7741.netlify.com
This is generated when you create a new site.

[codingo]

Closed via #53

[smartens80]

This vulnerability still exists (the company I work for was just informed by a white hat hacker that this affected us). If a sub domain (eg: mysubdomain.test.com) is pointing to a Netlify CNAME that is no longer in use by the original party and removed from the previous Netlify project, another party can add that subdomain to their own Netlify project and take it over.

[codingo]

@smartens80 it's one thing to highlight it, but it's another thing to do a claim. From my own testing it doesn't look like a claim isn't actually possible. Did they perform one in this case, or just let you know the DNS record was still there?

If you're unsure about this feel free to DM me on twitter under @codingo_ and we can talk through it further.

[codingo]

Potentially older domains are still vulnerable (without a seed), but this would still be considered an Edge Case. You should certainly be asking for proof of takeover on all reports though @smartens80.

[smartens80]

@codingo yes, they took over the sub domain and sent over as a poc. I've since removed the affected CNAME records from our DNS. I can PM you more info if you like?

[codingo]

Sounds good - I'm mostly interested in the format of the CNAME. What I suspect has happened is that older DNS records can still be taken over, and that this will need to be adjusted on the repository. If you can DM me it would be great to collect further information.