# Persistent XSS in www.starbucks.com

Starbucks latte-macchiato page loaded JS from an unregistered Elastic Beanstalk subdomain, allowing an attacker to register it and serve persistent XSS.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: ddworken
- Disclosed: 2017-01-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/188972
- Library page: https://bugbountylibrary.com/r/h1%3A188972
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:aws technique:recon vuln:subdomain-takeover vuln:xss

**Target:** www.starbucks.com product page script include
**Root cause:** The page referenced a script from starbucksmacchiato-prod.elasticbeanstalk.com, a subdomain not registered on Elastic Beanstalk and not resolving, leaving the reference hijackable.
**Steps:**
1. Visit `https://www.starbucks.com/coffee/espresso/latte-macchiato` and observe script load from `//starbucksmacchiato-prod.elasticbeanstalk.com/scripts/bn-v1.0.0-Release-min.js`
2. Resolve the subdomain and note it does not resolve / is unregistered on Elastic Beanstalk
3. Register `starbucksmacchiato-prod.elasticbeanstalk.com` on Elastic Beanstalk and deploy a webserver serving malicious JS at that path
4. Any visitor to the page loads attacker JS, yielding persistent XSS
**How found:** Noticed the page loaded a script from an elasticbeanstalk.com subdomain, then checked DNS resolution and found it did not resolve, indicating the subdomain was unclaimed and registrable.
**Exploitation:** Attacker registers the dangling Elastic Beanstalk subdomain and serves JavaScript at the referenced path; every visitor to the Starbucks page executes attacker-controlled script in the starbucks.com origin.
**Insight:** Grep page source for third-party script includes on cloud PaaS domains (elasticbeanstalk.com, herokuapp.com, etc.); if the subdomain doesn't resolve, it's a dangling-subdomain XSS waiting to be claimed.