Subdomain takeover of blog.snapchat.com
Snapchat does not have a lot of public facing subdomains, as of right now a basic subdomain scan on pentest-tools.com shows only 13 subdomains (compared to 799 for Facebook). I figured with a high profile bounty program like Snapchat these would be tested pretty hard and decided not to bother. However, I’ve been doing some Wordpress hacking lately and blog.snapchat.com caught my eye.
There’s nothing here.
I have limited experience with Tumblr but I assumed this was an unclaimed blog page. My first guess was that in the background they were pointing to some website like snapchat.tumblr.com, but that blog was already taken, so this was wrong.
After some digging I found out Tumblr has the same custom domain setup as many other websites:
- Point your DNS to their IP through an ANAME record
- Let the website deal with the CNAME stuff.
I was able to verify this by nslookup, seeing that snapchat-blog.com pointed to 188.8.131.52, an IP owned by Tumblr for custom domain routing.
# nslookup snapchat-blog.comNon-authoritative answer:
Viewing Google’s cached copy of this page shows this domain was properly claimed the day before (9/24). Snapchat must have accidentally removed the custom domain claim from their Tumblr account in the last 24 hours, probably in preparation for switching to snap.com/news for their recent re-branding.
After I figured out how Tumblr handled CNAMEs it was as easy as going to my account settings and claiming the domain name.
My First Tumblr
I decided to put my name on this subdomain for a valid PoC, so they knew threat actor activity was not the cause, and to aid Snapchat in fixing the vulnerability if they did not see the Hackerone report first. This ultimately led to me not receiving a bounty, since I did not handle this in a quieter matter. That was not my initial intention, but I can understand their position.
- 3:08 PM CDT: Issue reported to Snapchat on Hackerone
- 7:18 PM CDT: Snapchat confirms the vulnerability and asks me to redirect to the real blog for a temporary fix. They also redirected blog.snapchat.com to snap.com/news for a stronger fix.
- 8:33 PM CDT: Email contact begins to help transfer the snapchat-blog.com Tumblr ownership
- 9:59 AM CDT: Tumblr ownership is transfered to Snapchat
- 9:37 PM CDT: Report is closed
- 1:41 PM CDT: Request for public disclosure approved
Thank you to Snapchat for the quick response time and for running such a great bug bounty program. If you are interested in their program please visit https://hackerone.com/snapchat.