# Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry

Dangling CloudFront CNAME on partners.ubnt.com let researcher claim the subdomain and serve arbitrary content, enabling phishing and cookie theft.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: fransrosen
- Disclosed: 2016-11-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/145224
- Library page: https://bugbountylibrary.com/r/h1%3A145224
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:cdn technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** CloudFront CNAME DNS record for partners.ubnt.com
**Root cause:** DNS record for partners.ubnt.com still pointed to CloudFront, but no CloudFront distribution had it configured as a Custom CNAME, so anyone could register the domain to their own distribution.
**Steps:**
1. Resolve partners.ubnt.com and observe it CNAMEs to a CloudFront distribution endpoint.
2. Confirm no CloudFront origin claims partners.ubnt.com as a Custom CNAME (CloudFront does not validate ownership).
3. Create own CloudFront distribution and add partners.ubnt.com as a Custom CNAME.
4. Serve a file at `/login` on the distribution to prove control of http://partners.ubnt.com/login.
5. Optionally obtain a TLS cert via Let's Encrypt/AlphaSSL file or meta validation to serve HTTPS and read secure cookies.
**How found:** Researcher knew CloudFront does not validate CNAME ownership; checked partners.ubnt.com, saw it still resolved to CloudFront, and confirmed no distribution claimed it as a Custom CNAME.
**Exploitation:** Attacker registers the dangling domain as a Custom CNAME on their own CloudFront distribution, then serves arbitrary content (fake login, JS) under the trusted ubnt.com origin, capturing credentials and httpOnly/secure cookies.
**Escalation:** Adding a valid TLS certificate via Let's Encrypt/AlphaSSL enables HTTPS, allowing theft of secure cookies in addition to httpOnly cookies.
**Insight:** CloudFront (unlike some providers) does not verify domain ownership when adding a Custom CNAME, so any DNS record still pointing at CloudFront without an active distribution is claimable — enumerate CNAMEs to cloud CDNs and test claiming them.