# TLS Virtual Host Confusion

TLS virtual host confusion: servers with shared certs fall back to a default vhost for unrecognized Host headers, letting a DNS attacker impersonate other domains in the cert.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: adl
- Disclosed: 2014-11-10
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/501
- Library page: https://bugbountylibrary.com/r/h1%3A501
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:cdn technique:recon vuln:host-header vuln:info-disclosure vuln:misconfiguration

**Target:** HTTPS web servers / virtual host configurations (Akamai, CloudFlare, Dropbox, Pinterest)
**Root cause:** HTTP servers route requests with an unrecognized Host header to a configured default virtual host instead of rejecting them; when that default host is attacker-controlled or redirects to HTTP, domains sharing the same TLS certificate can be impersonated at the HTTP level.
**Steps:**
1. Attacker controls DNS for domain A, which shares a TLS certificate with victim domain B.
2. Redirect DNS for A to the server hosting B (or vice versa) so the shared cert validates.
3. Send a request with `Host: B` to the server; it does not match a configured vhost.
4. Server falls back to its default virtual host instead of rejecting the request.
5. If default host is attacker-controlled (e.g. Akamai fallback proxying to attacker servers), attacker serves content for B and steals cookies.
6. If default host redirects to HTTP, attacker intercepts the plaintext request (e.g. OAuth tokens).
**How found:** Researchers observed that HTTP servers route unrecognized Host headers to a default vhost, then tested servers by sending requests for hosts covered by their certificate but not served locally, finding thousands of vulnerable servers and specific exploitable fallbacks at Akamai, CloudFlare, Dropbox and Pinterest.
**Exploitation:** DNS attacker redirects a domain covered by a shared certificate to a co-tenant server; the server's default vhost handles the unrecognized Host, enabling full HTTP-level impersonation and secure/httpOnly cookie theft (demonstrated against Twitter, LinkedIn, PayPal, CNN, Microsoft, Apple via Akamai), Origin hijack/XSS (Dropbox), and OAuth token theft via HTTP redirect (Pinterest, CloudFlare).
**Escalation:** Chaining DNS control with shared-certificate co-tenancy and default-vhost fallback escalates from DNS hijack to full HTTP-level domain impersonation and cookie/token theft; SNI-stripping via SSL3 downgrade extends it to network attackers.
**Insight:** Probe HTTPS servers with Host headers for names in their certificate that they don't serve; a default vhost that proxies, hosts user content, or redirects to HTTP turns shared-certificate co-tenancy into full domain impersonation.