Subdomain takeover on *.apachecn.org

## Summary

The domain **apachecn.org.io** has a subdomain wildcard CNAME record pointing to **apachecn.github.io**. This allows an attacker to use any subdomain he wants on apachecn.org with Github pages.

## Security issue

An attacker could create it's own repository and configure it to use any subdomain he wants, allowing him to serve it's own content.

## POC

I have made [a POC](http://what-i-want.apachecn.org/).


## Remediation

Remove the wildcard CNAME record for apachecn.org.

## Impact

This issue make it possible for an attacker to carry out several type of attacks like XSS, phishing campaign or session hijacking.

首先检查 issue 中描述的通配符 CNAME 配置以及 what-i-want.apachecn.org 上链接的概念验证。确认 apachecn.org 是否仍将任意子域名路由到 apachecn.github.io；当通配符 CNAME 记录被移除，且概念验证子域名不再提供攻击者控制的内容时，即表示完成。

由索引模型根据 Issue 内容生成。