Subdomain takeover on *.apachecn.org

## Summary

The domain **apachecn.org.io** has a subdomain wildcard CNAME record pointing to **apachecn.github.io**. This allows an attacker to use any subdomain he wants on apachecn.org with Github pages.

## Security issue

An attacker could create it's own repository and configure it to use any subdomain he wants, allowing him to serve it's own content.

## POC

I have made [a POC](http://what-i-want.apachecn.org/).


## Remediation

Remove the wildcard CNAME record for apachecn.org.

## Impact

This issue make it possible for an attacker to carry out several type of attacks like XSS, phishing campaign or session hijacking.

首先檢查 issue 中描述的萬用字元 CNAME 設定，以及 what-i-want.apachecn.org 上連結的概念驗證。確認 apachecn.org 是否仍將任意子網域路由至 apachecn.github.io；當萬用字元 CNAME 記錄被移除，且概念驗證子網域不再提供由攻擊者控制的內容時，即表示完成。

由索引模型根據 Issue 內容生成。