# Subdomain takeover on s3.shopify.com

Dangling CNAME from s3.shopify.com to an unclaimed S3 bucket let anyone register it and serve arbitrary HTML/XSS and phishing content on the Shopify subdomain.

- Payout: $500
- Severity: medium
- Program: Shopify
- Credited: avlidienbrunn
- Disclosed: 2017-02-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/207576
- Library page: https://bugbountylibrary.com/r/h1%3A207576
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:aws tech:s3 technique:recon vuln:subdomain-takeover vuln:xss

**Target:** s3.shopify.com
**Root cause:** Dangling CNAME to an unclaimed S3 bucket allowed arbitrary content hosting on the Shopify subdomain.
**Steps:**
1. Resolve `s3.shopify.com` and observe CNAME chain to `shopify-assets.s3.amazonaws.com`
2. Attempt to create an S3 bucket named `shopify-assets` in the matching region
3. Upload `xss_unguessable3211231232.html` with script content
4. Fetch `http://s3.shopify.com/xss_unguessable3211231232.html` to confirm attacker-controlled content served on the Shopify subdomain
**How found:** Enumerated DNS records for Shopify subdomains, spotted a CNAME to an S3 hostname, and checked whether the target bucket name was still available for registration.
**Exploitation:** Attacker registers the dangling S3 bucket name, uploads arbitrary HTML/JS, and serves it under s3.shopify.com, enabling stored XSS in the Shopify origin and convincing phishing pages at the root path.
**Insight:** When enumerating subdomains, resolve CNAMEs to cloud storage hostnames and test bucket-name availability directly; a CNAME to `*.s3.amazonaws.com` where the bucket is unregistered is a takeover even without a matching subdomain label.