GitHub Community
Replies: 4 comments 2 replies
-
|
Bump |
Beta Was this translation helpful? Give feedback.
-
|
I just got hit by this. I had an old wildcard record pointing to my apex domain that I completely forgot about. Imagine my surprise when I get a Google alert for |
Beta Was this translation helpful? Give feedback.
-
|
@iglvzx thank you for sharing! This seems like a major security flaw. |
Beta Was this translation helpful? Give feedback.
-
|
I am now also affected by this. I would have never found out, if they wouldn't have registered my subdomain on Google Search Console, which notified me about this. |
Beta Was this translation helpful? Give feedback.
-
|
Was affected by this recently too. Similarly, I found out because the offender registered the subdomain with Google Search Console. |
Beta Was this translation helpful? Give feedback.
-
Background
Hi all! There is currently a security risk with GitHub pages, if you use a wildcard DNS setting. Your domains are not entirely protected from takeovers. I'm referring to this warning found here:
My Request
Verifying domain verification should "lock" the apex domain and all levels of subdomains to your account to prevent subdomain takeovers, even if you are using a wildcard DNS record.
When someone assigns a custom domain to their GitHub pages repository, GitHub should perform a check to see if the apex domain is currently verified under anyone else's GitHub account. If it is verified by someone else, then it cannot be used for your pages domain.
As a more general case, if I own
example.combut I only want to verifya.example.com, that should protect my domain from all levels of subdomains under*.a.example.com.On the other hand, the same security feature could be achieved if GitHub requires all domains/subdomains to be verified before using them in GitHub pages, however this could be annoying to many people.
Takeover Example
example.comand verify it to my GitHub account,nicfv.b.a.example.compointing tonicfv.github.io.evil-usersets up GitHub pages and assigns the CNAME in their repository tob.a.example.com, and they can host what they want.b.a.example.comor by setting the "custom domain" field in my pages repository, getting this error:evil-userstill has 1 week to host content using my subdomain. See How to claim a subdomain from a takeover? #69253 for details.Research
nicfvHost GH Pages**a.example.comnicfv.github.ioa.example.coma.example.comnicfv.github.ioa.example.comother.github.ioa.example.coma.example.comother.github.io*.example.comnicfv.github.io*.example.comnicfv.github.iob.a.example.comcan be taken over*.example.comother.github.io*.example.comother.github.iob.a.example.comcan be taken overb.a.example.comnicfv.github.iob.a.example.comb.a.example.comnicfv.github.iob.a.example.comb.a.example.comother.github.iob.a.example.comb.a.example.comother.github.iob.a.example.com*.a.example.comnicfv.github.ioa.example.com*.a.example.comnicfv.github.ioa.example.com*.a.example.comother.github.ioa.example.com*.a.example.comother.github.ioa.example.com* Assuming that only the apex domain
example.comis verified tonicfv** Assuming the subdomain is not already in use and has not been taken over.
The answers I've found [1], [2] don't explain the impact of verifying your domain on takeovers.
Results
<user>.github.iobut it doesn't seem to matter what string is in place of<user>. I have not tested this for organizations.<any-string>.github.io.example.com. If you point it to GitHub's servers before verifying it, it is also prone to takeovers until the verification is complete.Beta Was this translation helpful? Give feedback.
All reactions