# Subdomain takeover on svcgatewaydevus.starbucks.com and svcgatewayloadus.starbucks.com

Two Starbucks subdomains had dangling CNAMEs to unclaimed Azure Traffic Manager endpoints, letting anyone serve arbitrary content on starbucks.com.

- Payout: hidden
- Severity: critical
- Program: Starbucks
- Found by: blurbdust
- Disclosed: 2018-07-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/383564
- Library page: https://bugbountylibrary.com/r/h1%3A383564
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:critical tech:azure technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** DNS CNAME records to Azure Traffic Manager / Cloud App
**Root cause:** Two starbucks.com subdomains are pointed to Azure with an unclaimed CNAME record. The Traffic Manager endpoint resolves to a cloudapp.net resource no longer registered in Azure, so anyone can claim it.
**Steps:**
1. Resolve `svcgatewayloadus.starbucks.com` and `svcgatewaydevus.starbucks.com`; both return CNAMEs to `s00197tmp0crdfulload0.trafficmanager.net` and `s00197tmp0crdfuldev0.trafficmanager.net`
2. Follow the chain to the underlying cloudapp.net resource and confirm it is unregistered in Azure
3. Register the Cloud App in the Azure portal to gain full control of content served on the subdomains
4. Serve arbitrary content at `http://svcgatewayloadus.starbucks.com/` and `http://svcgatewaydevus.starbucks.com/`
**How found:** Followed the same pattern as a prior report on svcgatewayus.starbucks.com: enumerated sibling subdomains, resolved their CNAME chains to Azure Traffic Manager, and checked whether the terminal cloudapp.net resource was still registered.
**Exploitation:** Attacker registers the dangling Azure Cloud App/Traffic Manager endpoint, then serves arbitrary content on the starbucks.com subdomains; observed serving to 341 unique IPs within 45 minutes.
**Escalation:** Because CAs like Let's Encrypt only require domain verification, a valid SSL certificate can be issued for the taken-over subdomain, enabling convincing phishing and auth bypass.
**Insight:** When one subdomain in a naming family (e.g. svcgateway*us) is taken over, enumerate sibling variants (dev/load/prod) — they often share the same dangling Azure Traffic Manager template and are equally claimable.

## Proof of concept (copied exactly from the original report)

**DNS query showing unclaimed CNAME for load subdomain**

```
;; Server: 1.1.1.1:53
;; Size: 191
;; Unix time: 1531965036
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3697
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
svcgatewayloadus.starbucks.com. IN A

;; ANSWER SECTION:
svcgatewayloadus.starbucks.com. 600 IN CNAME s00197tmp0crdfulload0.trafficmanager.net.

;; AUTHORITY SECTION:
trafficmanager.net. 30 IN SOA tm1.msft.net. hostmaster.trafficmanager.net. 2003080800 900 300 2419200 30
```

**DNS query showing unclaimed CNAME for dev subdomain**

```
;; Server: 9.9.9.9:53
;; Size: 156
;; Unix time: 1531965036
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 47788
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
svcgatewaydevus.starbucks.com. IN A                                                                                                                                                            

;; ANSWER SECTION:
svcgatewaydevus.starbucks.com. 600 IN CNAME s00197tmp0crdfuldev0.trafficmanager.net.                                                                                                           

;; AUTHORITY SECTION:
trafficmanager.net. 30 IN SOA tm1.msft.net. hostmaster.trafficmanager.net. 2003080800 900 300 2419200 30
```

**PoC URLs serving attacker content**

```
#PoC:
http://svcgatewayloadus.starbucks.com/
http://svcgatewaydevus.starbucks.com/
```