# Subdomain takeover on mta1a1.spmail.uber.com

Dangling AWS elastic IP in mta1a1.spmail.uber.com A record let researcher reallocate the IP and take over the subdomain, exposing scoped cookies and CORS.

- Payout: hidden
- Severity: medium
- Program: Uber
- Found by: 0x3c3e
- Disclosed: 2020-04-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/707748
- Library page: https://bugbountylibrary.com/r/h1%3A707748
- Tags: area:cloud domain:cloud impact:ato kind:bounty platform:hackerone sev:medium tech:aws technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** DNS A record / AWS elastic IP for mta1a1.spmail.uber.com
**Root cause:** The subdomain's A record pointed to an AWS elastic IP that had been released back to the pool, so anyone allocating that IP could serve content for the hostname.
**Steps:**
1. Resolve `mta1a1.spmail.uber.com` A record to obtain the stale IP.
2. Allocate that same IP from the AWS elastic IP pool.
3. Bind the IP to an attacker-controlled instance and serve content for the hostname.
**How found:** Researcher noticed the A record pointed to an IP that could be re-acquired from AWS's elastic IP pool — an 'IP use-after-free' — and confirmed by allocating it.
**Exploitation:** Attacker reallocates the dangling elastic IP and hosts content under mta1a1.spmail.uber.com, gaining access to subdomain-scoped cookies and CORS trust to facilitate phishing.
**Escalation:** Subdomain-scoped cookies and CORS trust could be leveraged for phishing/credential theft against Uber users.
**Insight:** Enumerate A records pointing at cloud provider IP pools (AWS EIP, GCP) and check whether the address is currently unassigned; if reallocatable, you inherit the hostname's cookie/CORS trust.