HexBrain

Legal Robot · Report #250766

Subdomain misconfiguration [mail.legalrobot.com]

Informativestatus
31 Jul 2017disclosed

How it was found

Hi Team,

You subdomain mail.legalrobot.com has a CNAME record that resolved to ghs.google.com and shows error when navigating to subdomain, should remove CNAME entry for that subdomain pointing towards ghs.google.com.I couldn't verify the domain ownership process to fully takeover subdomain. mail.legalrobot.com canonical name = ghs.google.com For POC i have claim the domain of gsuite account using mail.legalrobot.com

Fix: To fully resolve the issue you need to remove the CNAME record and put in place a web forwarding rule for mail.legalrobot.com towards new web landing page.

Please find the attachment of POC.

Thanks _prakash

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original