2 ms·
I can't recall all the exact details, but there is some validation logic in place along the lines of "if there's a wildcard domain installed then newly added su
by brandur 10y ago
I can't recall all the exact details, but there is some validation logic in place along the lines of "if there's a wildcard domain installed then newly added subdomains must be on the same account as the wildcard's owner". You could give it a shot, but I don't think this attack would work.
(I used to help maintain the system responsible for this, but don't work there anymore.)
- bdittmer 10y agoThis was probably 2012 or 2013. I'll try to find the write up I sent them, but this check definitely did not exist then edit: here's what we sent to heroku https://gist.github.com/bdittmer/6461b7a5093acd7d6263 https://gist.github.com/bdittmer/6461b7a5093acd7d6263