Vulnerable Service: makeswift.site

[dalpan]

makeswift.site is a service provided by MakeSwift that enables clients to use custom domains via CNAME records pointing to makeswift.site.

When the associated MakeSwift project is deleted or not configured properly, the subdomain becomes unclaimed, resulting in a 404 error. This state renders the subdomain vulnerable to takeover.

Proof

Setup a CNAME pointing to makeswift.site
Example:

vulnerable.example.com CNAME makeswift.site  

Check for Vulnerability
Access the subdomain (https://vulnerable.example.com) and observe a response like (Error Vercel):

404: NOT_FOUND
Code: DEPLOYMENT_NOT_FOUND

Takeover the Subdomain

Go to setting MakeSwift project.
Add the custom domain (vulnerable.example.com) in the MakeSwift dashboard.

Verify ownership through DNS and Set as primary domain

if the subdomain is vulnerable, it will show the page that we created

Documentation

https://docs.makeswift.com/product/site/domains