Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com

Program: Grab Bug Type: Subdomain takeover Bounty: 1000 Date: 2018-05-16
subdomain-takeover

Summary

The researcher found a subdomain takeover vulnerability in cdn.grab.com which had a dangling CNAME pointing to a cloudfront instance. The subdomain was not registered on amazon Aws Cloudfront. The researcher was able to successfully takeover the domain by registering a cloudfront subdomain.

References