S3 bucket takeover [learn2.khanacademy.org]
High
K
Khan Academy
Submitted None
Actions:
Reported by
fdeleite
Vulnerability Details
Technical details and impact analysis
The subdomain learn2.khanacademy.org was pointed to Amazon S3, but no bucket with that name was registered [learn2.khanacademy.org]. This meant that anyone could sign up for Amazon S3, claim the bucket as their own and then serve content.
## Steps to reproduce
Check the following url:
http://learn2.khanacademy.org
Also
```
> curl -k http://learn2.khanacademy.org/
<!doctype html>
<html>
<head>
<title>S3 takeover POC</title>
</head>
<body>
<p>This is S3 takeover POC </p>
</body>
</html>
```
## Impact
It's extremely vulnerable to attacks as a malicious user could create any web page with any content and host it on the `ford.com` domain. This would allow them to post malicious content which would be mistaken for a valid site.
They could perform several attacks like:
- Cookie Stealing
- Phishing campaigns.
- Bypass Content-Security Policies and CORS.
## Recommendations for fix
* Remove the affected DNS record
### Supporting Material/References:
- https://0xpatrik.com/subdomain-takeover/
- https://hackerone.com/reports/661751
Report Details
Additional information and metadata
State
Closed
Substate
Resolved