# Subdomain takeover on svcgatewayus.starbucks.com

Dangling CNAME chain from svcgatewayus.starbucks.com to an unregistered Azure Cloud App let anyone claim the subdomain and control its content.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: 0xpatrik
- Disclosed: 2018-06-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/325336
- Library page: https://bugbountylibrary.com/r/h1%3A325336
- Tags: area:cloud domain:cloud impact:integrity kind:bounty platform:hackerone sev:critical tech:azure technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Azure Cloud App / Traffic Manager CNAME chain under starbucks.com
**Root cause:** svcgatewayus.starbucks.com CNAMEs to a Traffic Manager endpoint that CNAMEs to an Azure Cloud App (1fd05821-7501-40de-9e44-17235e7ab48b.cloudapp.net) no longer registered in Azure, leaving the DNS record dangling.
**Steps:**
1. Resolve svcgatewayus.starbucks.com and follow the CNAME chain: s00197tmp0crdfulprod0.trafficmanager.net -> 1fd05821-7501-40de-9e44-17235e7ab48b.cloudapp.net.
2. Observe the final cloudapp.net host is unregistered in Azure.
3. Register the Cloud App in the Azure portal to gain control of content served at svcgatewayus.starbucks.com.
4. Verify takeover at `http://svcgatewayus.starbucks.com`.
**How found:** Enumerated subdomains and followed CNAME chains to cloud providers, spotting a cloudapp.net target that was no longer registered.
**Exploitation:** Attacker registers the dangling Azure Cloud App name, then serves arbitrary content on the Starbucks subdomain; domain-validated TLS certs (e.g. Let's Encrypt) can be issued since only domain verification is required.
**Escalation:** Enables malware distribution, phishing, XSS and authentication bypass under the trusted starbucks.com origin.
**Insight:** Follow multi-hop CNAME chains (brand domain -> Traffic Manager -> cloudapp.net) to the final provider resource; the intermediate Traffic Manager record can mask a dangling leaf that is claimable.