Ubiquiti Inc. · Report #181665

Subdomain Takeover (moderator.ubnt.com)

Validstatus

highseverity

19upvotes

6 Feb 2017disclosed

How it was found

Hello Team

This report is same as #179110

One of your subdomain http://moderator.ubnt.com is pointing towards

216.58.203.243    moderator.ubnt.com
216.58.203.243    ghs.google.com
216.58.203.243    ghs.l.google.com

{F134183} And it is unclaimed

When I open it it is showing

{F134184}

Impact :- An attacker can claim this subdomain by requesting a process of registering this abandoned subdomain to his name.

And attacker can fully take over this subdomain and do whatever he wants. this can cause huge damage to the website's main domain as well as to the company.

I Recommend removing the Cname and DNS connecting to it.

You can read about this sort of attacks here : https://www.siteground.com/tutorials/googleapps/google_calendar.htm

To clarify your doughs I just added video POC

1ST Video Is about how I am able to claim it https://youtu.be/51Ku4cGbijE 2ND Video is proof when trying to claim it for the second time https://youtu.be/GJcWsHJj8aE

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original