Snapchat · Report #274336
Subdomain Takeover via Unclaimed WordPress site
Validstatus
mediumseverity
39upvotes
6 Oct 2017disclosed
Summary
@ysx found a bitstripsforschools CNAME entry pointing to an unclaimed WordPress domain, which could be taken over by an external party.
The CNAME entry was for a product that is no longer active.
An unclaimed WordPress domain mapping upgrade could be leveraged to assume the blog.bitstripsforschools.com subdomain and serve arbitrary content in the Bitstrips context. Thanks again to @babak for the swift communication and remediation.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.