TikTok · Report #1102537
Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)
Validstatus
lowseverity
$200bounty
29upvotes
7 Nov 2022disclosed
Summary
An unclaimed Amazon S3 bucket which no longer used for any TikTok applications and did not host any user data could have allowed a takeover on a musical.ly subdomain. We thank @daik0n for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.