# URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS

Dangling CNAME from media.vine.co to vines.s3.amazonaws.com let the researcher claim the S3 bucket and host phishing/XSS content on a Vine subdomain.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: fransrosen
- Disclosed: 2014-11-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/32825
- Library page: https://bugbountylibrary.com/r/h1%3A32825
- Tags: area:cloud domain:cloud impact:integrity kind:bounty platform:hackerone sev:high tech:aws tech:s3 technique:recon vuln:subdomain-takeover vuln:xss

**Target:** media.vine.co subdomain / AWS S3 bucket
**Root cause:** media.vine.co was aliased via CNAME to vines.s3.amazonaws.com but no bucket named 'vines' existed, so anyone could register it and serve content under the Vine domain.
**Steps:**
1. Resolve media.vine.co and observe `media.vine.co is an alias for vines.s3.amazonaws.com`.
2. Note the referenced S3 bucket 'vines' is unclaimed (S3 matches bucket name to CNAME).
3. Register the bucket 'vines' in the correct region (West-1) to serve content.
4. Host a login form at `http://media.vine.co/login` to demonstrate phishing/XSS on the Vine domain.
**How found:** DNS recon: noticed the subdomain CNAME pointed to an S3 endpoint, then checked whether the corresponding bucket name was claimable.
**Exploitation:** Attacker claims the dangling S3 bucket and serves arbitrary content (e.g. a fake login form) on media.vine.co, enabling phishing, XSS in the vine.co origin, and malware distribution under the trusted brand.
**Escalation:** Root URL serving would work if the bucket were created in the correct region (West-1), extending control to the full subdomain root.
**Insight:** When a subdomain CNAMEs to an S3 endpoint, the bucket name must equal the CNAME target; if that bucket is unregistered you can claim it — and region choice determines whether root-URL serving works.