Subdomain takeover on *.apachecn.org

## Summary

The domain **apachecn.org.io** has a subdomain wildcard CNAME record pointing to **apachecn.github.io**. This allows an attacker to use any subdomain he wants on apachecn.org with Github pages.

## Security issue

An attacker could create it's own repository and configure it to use any subdomain he wants, allowing him to serve it's own content.

## POC

I have made [a POC](http://what-i-want.apachecn.org/).


## Remediation

Remove the wildcard CNAME record for apachecn.org.

## Impact

This issue make it possible for an attacker to carry out several type of attacks like XSS, phishing campaign or session hijacking.

Start by reviewing the wildcard CNAME configuration described in the issue and the linked proof of concept at what-i-want.apachecn.org. Confirm whether apachecn.org still routes arbitrary subdomains to apachecn.github.io; done means the wildcard CNAME record is removed and the proof-of-concept subdomain no longer serves attacker-controlled content.

Written by the indexing model from the issue text.