Vulnerable Service: cloud.appwrite.io

[dalpan]

Service name

cloud.appwrite.io is a service provided by Appwrite that allows clients to use custom domains by setting up a CNAME record pointing to cloud.appwrite.io.

If the custom domain is unclaimed or the associated Appwrite project is deleted, the subdomain becomes vulnerable to takeover. This occurs because the DNS record remains active, but the service no longer verifies ownership or serves content, leading to a 403 error.

Proof

Setup a CNAME pointing to cloud.appwrite.io
Example:

vulnerable.example.com CNAME cloud.appwrite.io

Check for Vulnerability
Access the subdomain (https://vulnerable.example.com) and observe a response like:

Error 1014
"CNAME Cross-User Banned."  

Takeover the Subdomain

Go to console and create a new Appwrite project.
Add the custom domain (vulnerable.example.com) in the Appwrite dashboard.

Verify ownership through DNS.

If it is vulnerable, the domain will change to the appwrite login page when accessed.

Documentation

https://appwrite.io/docs/advanced/platform/custom-domains