Subdomain takeover of datacafe-cert.starbucks.com
Program: starbucks
Bug Type: Subdomain takeover
Bounty: Unspecified
Date: 2019-08-01
subdomain-takeover
dns
azure
cloud-misconfiguration
domain-hijacking
Summary
The researcher found a subdomain owned by Starbucks - datacafe-cert.starbucks.com, having a CNAME record pointing to an unclaimed Azure web service at azurewebsites.net. This meant that the subdomain was dangling: it still pointed to an Azure app that no longer existed. By registering the same app name on Azure (e.g., datacafe-cert.azurewebsites.net), the researcher was able to take control of the Starbucks subdomain. This allowed them to serve content under *.starbucks.com, effectively achieving a subdomain takeover a high-severity vulnerability due to the potential for phishing, cookie theft, or internal application abuse.