Researchers Hijack Over 2,000 Subdomains From Legitimate Sites in CloudFront Experiment

[Faybert]

Content source

https://www.bleepingcomputer.com/news/security/researchers-hijack-over-2-000-subdomains-from-legitimate-sites-in-cloudfront-experiment/

Security experts from MindPoint Group, an information security firm, have hijacked over 2,000 subdomains from legitimate websites while researching possible security flaws in Amazon's CloudFront CDN service.
Experts found that CloudFront's CDN routing mechanism that linked a site's domain and subdomains to a specific server contained a flaw that allowed attackers to point misconfigured subdomains to their own endpoint instead, effectively hijacking the subdomain from legitimate CloudFront users.
Custom script hijacks over 2,000 official subdomains
MindPoint security analyst Matt Westfall coded and deployed a proof-of-concept Python script that automatically scanned CloudFront domains and hijacked vulnerable subdomains, pointing the servers to a demo page he created.
Westfall says he hijacked over 2,000 subdomains over the period of a few days just by using his script. Some of the most high-profile subdomains belonged to companies such as the Red Cross, Bloomberg, Reuters, Dow Jones, Harvard, University of Maryland, the Commonwealth Bank of Australia, and two US government agencies.
.....
.....
.....

 

[disloops]

Here is the link to the original blog article we wrote up:
CloudFront Hijacking | MindPoint Group

And here is the scanning tool that I created during this effort:
MindPointGroup/cloudfrunt

 

[upnorth]

Hi Matt and warm welcome to MT!

AWS has deemed that this is not a vulnerability in the CloudFront service.

Did they explain a bit more about there reson for that conclusion? Sounds odd IMO as you wrote that the CloudFront team themself did acknowledge the issue.

 

[disloops]

Thanks!

To use CloudFront, a user points their domain at a unique endpoint that CloudFront assigns to a specific distribution (ex. d111111abcdef8.cloudfront.net). However, a request to that domain can arrive at a totally different CloudFront distribution with another endpoint. The unique endpoints are effectively meaningless because CloudFront only uses the HOST header of the request to determine which distribution to serve content from. That seems to be the issue that causes the most potential for takeover, but it is not something AWS considers a strict vulnerability.