HexBrain

Snapchat · Report #114134

Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition)

Validstatus
14upvotes
16 Feb 2016disclosed

Summary

harry_mg helped us identify an issue in which support.scan.me's CNAME was pointing to scan.zendesk.com. Normally there would be a Zendesk instance there, but in this case, the Zendesk instance was no longer in use. As such, harry_mg was able to "claim" scan.zendesk.com from Zendesk. As such, any content he decided to put on scan.zendesk.com would be visible at support.scan.me. Since support.scan.me was no longer in use, Snapchat resolved this issue by removing it. Snapchat awarded harry_mg for notifying us of this issue with a $1,000 bounty. Thanks harry_mg!

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original