# Subdomain Takeover to Authentication bypass

Dangling HubSpot CNAME on devrel.roblox.com let an attacker claim the subdomain, steal .ROBLOSECURITY cookies and read chats via CORS.

- Payout: hidden
- Severity: critical
- Program: Roblox
- Found by: geekboy
- Disclosed: 2020-04-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/335330
- Library page: https://bugbountylibrary.com/r/h1%3A335330
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical tech:cdn technique:recon vuln:account-takeover vuln:cors vuln:subdomain-takeover

**Target:** devrel.roblox.com subdomain / HubSpot-hosted CNAME
**Root cause:** devrel.roblox.com had a CNAME pointing to an unclaimed/expired HubSpot instance, allowing anyone to register it and serve content under the Roblox origin.
**Steps:**
1. Resolve devrel.roblox.com and observe CNAME to an unclaimed/expired HubSpot instance.
2. Claim the HubSpot instance and host content at https://devrel.roblox.com/subdomain-takeover.
3. Serve a cookie-stealing page that reads document.cookie (scoped to *.roblox.com) and exfiltrates .ROBLOSECURITY.
4. Serve JS that issues credentialed XHR to `https://chat.roblox.com/v2/get-messages?conversationId=469104576&pageSize=3` with `withCredentials = true` to read chats via whitelisted CORS origin.
**How found:** Noticed the subdomain's CNAME pointed to a HubSpot instance that was unclaimed/expired, then checked cookie scoping and CORS whitelist entries for devrel.roblox.com to assess impact.
**Exploitation:** Attacker claims the dangling HubSpot target, hosts pages on devrel.roblox.com; victims visiting the subdomain leak .ROBLOSECURITY cookies (domain-scoped to .roblox.com) enabling account takeover, and the whitelisted origin allows credentialed CORS reads of chat.roblox.com messages.
**Escalation:** Cookie theft chains to full account takeover across all *.roblox.com subdomains; CORS whitelist abuse extends to reading private chat messages.
**Insight:** When a subdomain is CORS-whitelisted by sibling services and shares domain-scoped cookies, a dangling CNAME there is far more than defacement—enumerate CORS allowlists and cookie Domain attributes to size takeover impact.