# Dangling hostname trusted by script or CSP

Third-party hostnames in script src or CSP allowlists that resolve to claimable cloud/CDN namespaces

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $200 and $3,100; latest 2023-05-30. Updated 2026-10-24._

## How it works
A page or policy trusts a hostname that the site does not actually control. The hostname points into a shared namespace (a CDN, PaaS, or object store) where any account holder can register that exact name. Because the trust decision was made on the string, not on who owns the name, an attacker who claims the name inherits the site's trust and can serve script or content under it. The broken assumption: "a hostname we reference is a hostname we own."

## Where it shows up
- `script src` or other includes pointing at cloud PaaS/CDN domains (elasticbeanstalk.com, herokuapp.com, freetls.fastly.net, s3.amazonaws.com) [E2](https://bugbountylibrary.com/r/h1%3A188972.md)[E3](https://bugbountylibrary.com/r/h1%3A716677.md)
- CSP `script-src`/`connect-src` allowlists containing third-party shared-hosting subdomains [E3](https://bugbountylibrary.com/r/h1%3A716677.md)
- Referenced hostnames that do not resolve (unclaimed) [E2](https://bugbountylibrary.com/r/h1%3A188972.md)
- Domain-uniqueness checks that compare raw strings, so canonical variants slip past [E1](https://bugbountylibrary.com/r/h1%3A1086108.md)

## How to review
For every hostname the page loads from or the CSP trusts, confirm ownership: does it resolve, and is the name registered to the organization in that provider's namespace? The invariant: every trusted origin must be one the site controls, or a namespace where the exact name cannot be claimed by others. For uniqueness checks, verify canonicalization (trailing dot, case, IDN/punycode, encoding) is applied before comparison so equivalent names collide [E1](https://bugbountylibrary.com/r/h1%3A1086108.md).

## Variants seen
- Dangling PaaS subdomain in a script include, unregistered and registrable [E2](https://bugbountylibrary.com/r/h1%3A188972.md)
- CDN subdomain whitelisted in CSP, claimable by any account [E3](https://bugbountylibrary.com/r/h1%3A716677.md)
- Trailing-dot FQDN bypassing a duplicate-domain check to claim a customer domain [E1](https://bugbountylibrary.com/r/h1%3A1086108.md)

## Impact and severity
Led to persistent XSS on a major site [E2](https://bugbountylibrary.com/r/h1%3A188972.md), CSP bypass and script execution [E3](https://bugbountylibrary.com/r/h1%3A716677.md), and arbitrary content on customer domains [E1](https://bugbountylibrary.com/r/h1%3A1086108.md). Severity is high because the trusted origin executes in the site's context; it worsens when the hostname sits in CSP (defeats the control meant to stop injection) or affects many customer domains at once [E1](https://bugbountylibrary.com/r/h1%3A1086108.md)[E3](https://bugbountylibrary.com/r/h1%3A716677.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1086108.md
- E2: https://bugbountylibrary.com/r/h1%3A188972.md
- E3: https://bugbountylibrary.com/r/h1%3A716677.md