3 ms·
> Am I missing something? How would AWS S3 stop you from creating a CNAME? Or how is this their responsibility? They (AWS) should not accept traffic on that ho
by elithrar 5y ago
> Am I missing something? How would AWS S3 stop you from creating a CNAME? Or how is this their responsibility?
They (AWS) should not accept traffic on that hostname until ownership - tightly bound - is proven.
This also helps avoid related cases, such as deleting a bucket (which now frees it up) - other services like Heroku have similarly been vulnerable to this takeover hack because of a lack of strict verification: https://0xpatrik.com/subdomain-takeover-providers/ https://0xpatrik.com/subdomain-takeover-providers/
Every new bucket, service or account handling traffic for a domain should require re-verification. That verification should never persist beyond the lifetime of that resource.
- elcomet 5y ago> They (AWS) should not accept traffic on that hostname until ownership - tightly bound - is proven. Why shouldn't they ? Don't you think it can be a useful feature ?
- FlyingAvatar 5y agoThe problem is that AWS only allows hosting domains on S3 that match the hostname. i.e. If I want to host some content from S3 on 'static.mydomain.com', I MUST own the bucket of the same name. If someone else creates the bucket on their AWS account, I am stuck. I would have to use a different hostname, or use a more complex workaround. Since creating empty buckets costs nothing, it effectively allows DoSing hostnames from an S3 hosting standpoint. It would be one thing to allow this behavior if a domain owner explicitly wanted it, via a TXT record or something, but as it is, it's a poorly designed solution.