1368780 - Subdomain Takeover at qsurvey.mozilla.com via bypass # 4

Status: RESOLVED FIXED

(Websites :: Other, defect)

Description

[ak1t4]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.1.1 Safari/603.2.4

Steps to reproduce:

Summary

(this is a new bypass for takeover qsurvey.mozilla.com subdomain)

Hi team, i report this critical issue,  i’been able to  complete takeover the subdomain qsurvey.mozilla.com

this subdomain  is pointing to an external 3rd party service (surveygizmo.com)

I veen able to bypass the branded custom domain feature and Takeover the Subdomain


Reproduction Steps & Poc

1) Go to http://qsurvey.mozilla.com/reportsview/?key=560311-7272117-3cadb2fe215544bac4d4abb5a797abdc&pfl=2-5f49b13375f8f20dccc712278dd2a020

2) You see the alert box and the Subdomain Takeover


Security Impact

An attacker can utilize this the vulnerable domain for targeting the organization by fake login forms, spread phishing, steal sensitive Users information (site accounts, steal credentials, cookies, credit card information,  etc)

FIX & MITIGATION


*Contact vendor asap for patch or launch a Fix (surveygizmo.com)


[ SurveyGizmo Section ]

1) Go to reports
2) Create “profile report”
3) At https://app.surveygizmo.com/Reports/profilelist/reportid/[xxxxx]/id/[xxxxxx] you can see “public link”, Use it and change it with any other vulnerable domain like qsurvey.mozilla.com

4) You see the subdomain takeover and alert popup

PoC link -> http://qsurvey.mozilla.com/reportsview/?key=560311-7272117-3cadb2fe215544bac4d4abb5a797abdc&pfl=2-5f49b13375f8f20dccc712278dd2a020

-


Please let me know if more info needed or any help,

Best Regards,
@ak1t4

Comment 1

[ak1t4]

Just for heads up!  SG support has reply, from [ [e-mail] ]
	
"
Hi Bug Bounty Hunter-

Thank you for reporting this to us, we greatly appreciate it. We are having our system administrators investigate and verify this vulnerability. Once it has been verified and the patch has been released I will notify you here. I am not certain how we will be compensating you for this but I will let you know very soon!

Thank you,
Ally
"

I hope they can fix this asap,

regards,
@ak1t4

Comment 2

[ak1t4]

Attachment: sg-bypass-4.png

Comment 3

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Ally: FYI, this is a brand new takeover vuln that was reported today.

Comment 4

[ak1t4]

Hi there! I re-test this issue and seems fixed!
Can you confirm this with SG team?

Comment 5

[Ally]

Yes we released the patch for this!!

Comment 6

[ak1t4]

Awesome, that was fast! congrats!

Comment 7

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Ally: with the recent fix, could you describe the fix in some detail?  I'm asking because this is the 4th occurrence of this issue in recent months and I'm concerned we're not getting to the root cause issue.

Comment 8

[Ally]

Yes - The fix was basically applying our validation that prevents domain take over that we’re using in other parts of the system (surveys, new reports, etc) to this new vector.  Our QA team is currently working on an audit to identify any other vectors for domain take overs.  Additionally, our security group is research tools and tests to try and automate these vulnerabilities.