Vulnerable Service: hashnode.com

[dalpan]

Hashnode is a service provided by Hashnode that enables clients to use custom domains via CNAME records pointing to hashnode.network.

When the associated Hashnode project is deleted or not configured properly, the subdomain becomes unclaimed, resulting in a 404 error. This state renders the subdomain vulnerable to takeover.

Proof

Setup a CNAME pointing to hashnode.network
Example:

vulnerable.example.com CNAME hashnode.network  

Check for Vulnerability
Access the subdomain (https://vulnerable.example.com/) and observe a response like (Error Vercel):

404: NOT_FOUND
Code: DEPLOYMENT_NOT_FOUND

Takeover the Subdomain

• Go to Hashnode dashboard.
• Create a blog or docs page

• Add the custom domain (vulnerable.example.com) in the blog/docs dashboard.

if the subdomain is vulnerable, it will show the page that we created

Documentation

https://support.hashnode.com/en/articles/5755362-how-to-map-a-custom-domain