# Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront

rider.uber.com CNAME pointed to an unclaimed CloudFront distribution, letting an attacker register it and serve content on Uber's domain.

- Payout: hidden
- Severity: high
- Program: Uber
- Found by: fransrosen
- Disclosed: 2016-12-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/175070
- Library page: https://bugbountylibrary.com/r/h1%3A175070
- Tags: area:cloud domain:cloud impact:integrity kind:bounty platform:hackerone sev:high tech:cdn vuln:misconfiguration vuln:subdomain-takeover

**Target:** CloudFront distribution / DNS CNAME
**Root cause:** rider.uber.com had a DNS CNAME to a CloudFront distribution that no longer existed, so the distribution name was unclaimed and anyone could create it.
**Steps:**
1. Observe `rider.uber.com` returning a CloudFront error page on HTTP and HTTPS, indicating no distribution exists.
2. Create a new CloudFront distribution claiming the dangling CNAME target.
3. Add an Alternate CNAME for `rider.uber.com` to the new distribution.
4. Serve PoC content at `http://rider.uber.com/login-poc` to confirm control.
**How found:** Recognized the CloudFront error response as a signature of a dangling distribution, referencing prior research on trailing-dot domains and AWS/CloudFront takeovers.
**Exploitation:** Attacker registers the orphaned CloudFront distribution and adds rider.uber.com as an alternate CNAME, gaining full control of content served on the trusted Uber subdomain (e.g. phishing login page).
**Insight:** A CloudFront error page on a branded subdomain is a takeover signal: check whether the CNAME target distribution still exists and can be re-registered with that hostname as an alternate CNAME.