Closed sofyanmoch closed 1 month ago
@sofyanmoch thanks for the report and I can confirm this bug, looks like an oversight - this is something we are already looking at.
@mudler hi, I've reported it via email to help@masa.finance since 4th of July. but there was no reply . My email is aondaop@gmail.com
These CNAMEs are now removed.
@mudler @Luka-Loncar -- we should make a new ticket, maybe a "chore" - to go through all our domains and audit the rest of the CNAMEs; there are many more that are not in use and could conceivably be targeted this way.
Hi, after check again this issue has been solved
Seems solved now - closing. Thanks @sofyanmoch for the report
Vulnerability Details :
A subdomain takeover occurs when an attacker gains control over a subdomain of a target domain. Typically, this happens when the subdomain has a canonical name (CNAME) in the Domain Name System (DNS), but no host is providing content for it. This can happen because either a virtual host hasn't been published yet or a virtual host has been removed. An attacker can take over that subdomain by providing their own virtual host and then hosting their own content for it.
If an attacker can do this, they can potentially read cookies set from the main domain, perform cross-site scripting, or circumvent content security policies, thereby enabling them to capture protected information (including logins) or send malicious content to unsuspecting users.
Domain Affected :
Steps To Reproduce :
Reference :
Severity :
High (based on here https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2)
Impact:
Your company is engaged in crypto. It will be a problem when the attacker can do :
In addition: Malware distribution You lose your reputation.
Solutions :
For a long-term solution to prevent domain takeover :
Screenshot