-
-
Notifications
You must be signed in to change notification settings - Fork 704
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cloudfront takeover is not possible anymore #29
Comments
It is still possible to takeover in cases: But this is a rare case. |
It seems like CloudFront, when creating the distribution, resolves the subdomain and checks the CNAME record for |
Okey! so i found a sub that's giving the save bad request error on both http & https and have a CNAME as site.com tried takeover successfully added to cloudflare dist but the error remains the same so i guess it's indeed fixed |
It won't work in this case, agree (this scenatio is fixed), but there are edge cases when it will still work. I had two such edge CF takeover cases (Jan 2019) in the IBM program |
@Sp1d3r Indeed i was wrong i played a little and was able to takeover the subdomain successfully! |
Gotcha, congrats with the vuln! |
@MuhammadKhizerJaved What was your solution, How did you manage to takeover it |
@MuhammadKhizerJaved hey can you please tell us how you manage to takeover it? |
hello @Sp1d3r @MuhammadKhizerJaved can you please explain , how you able to takeover ..? |
It seems that CloudFront is no longer vulnerable to a subdomain takeover.
|
Goodbye to CloudFront subdomain takeover. |
If somehow an attacker can issue a valid certificate using any CA defined on Mozilla trusted store so I think it'd be possible. Didn't get any case that I could try. |
@riramar If it's possible, It will be a bypass for takeover and probably a bug on Amazon Cloudfront itself rather then misconfiguration on Cloudfront lead to a takeover. |
someone recently tookover a subdomain via cloudfront: |
@eranshmuely this report is from two years ago (from when this was possible), it's just that it has only been disclosed in the past 15 hours. |
Oh, right, sorry about that |
Brother, I have the same edge case but still getting that ssl error, is aws entirely fixed it? or I am doing something wrong? |
i have found an ip pointing to cloudfront both http and https shows same error. direct ip to cloudfront subdomain . is it possible to takeover ? |
@shubham4500 The first message of this issue explicitly explains the VERY SAME THING you are talking about ... |
it didnt showed the way :( do you encountered issue like this anytime ? @melardev |
@Sp1d3r direct ip to cloudfront.... |
Again, the first message clearly states we can not anymore, there are hundreds of these out there, if takeover is possible i would be rich now. Unless you find a bypass on AWS itself there is no way. |
|
I just tried 2 subdomains and i coudln't because it requested a valid ACM certificate. |
i have found a subdomain with a CNAME like *.ubnt.com and that one has a CNAME to something.cloudfront.net but i still can't register the main subdomain... do you really thing it is possible? |
@marcelo321 I think no, since the certificate feature stuff. |
@Sp1d3r i also just found a subdomain with a CNAME pointing to example.awsdns-hostmaster.amazon.com |
Hey There, Now i had found a site with CNAME dxxxxxxx.cloudfrount.net, but my account is asw haven't fully activated yet. Could i take over this domain ? thanks ! |
@danielanonymous Hi, did you succeed or is it still impossible? |
If this is mitigated by aws then how it can be possible? see the report below of subdomain takeover on cloudfront in 2019 and fix was pushed in 2018. |
Report is from 2018, 2 years ago, and was already discussed in this issue above. It was DISCLOSED in 2019. Please review carefully. |
Hello , Consider that the website as well as CNAME , both returns 'DNS_PROBE_FINISHED_NXDOMAIN' error ! |
How to exploit this kind of bug? |
AWS finally started mitigating subdomain takeovers on CloudFront. When you try to register Alias (CNAME) for your CloudFront distribution, it refuses to do so if the DNS zone file has CNAME to different CloudFront domain.
This is a type of verification from cloudfront that you can't takeover any subdomain even both (http OR https) port (80 and 443) shows error.
If the DNS zone file has CNAME to different CloudFront domain.
so,from cloudfront bye bye bug bounty
When you try to takeover subdomain you will get this as a further alert!
The text was updated successfully, but these errors were encountered: