Shopify · Report #221631

[ux.shopify.com] Subdomain takeover

Validstatus

mediumseverity

26upvotes

19 Oct 2018disclosed

How it was found

The subdomain ux.shopify.com points to domains.tumblr.com, but this subdomain is not used by anyone on Tumblr. Any user can register his blog for this subdomain.

ux.shopify.com.	3600	IN	CNAME	domains.tumblr.com.

{F176574}

As an PoC, I registered a blog for this subdomain. It is available only with the password c7gBX6gELPFLhYOeYxQD.

http://ux.shopify.com/

{F176578}

You need to remove the DNS entry ux.shopify.com. Or I can release this subdomain so that you can register it.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original