↓ Skip to main content
Rows of cross-connect frames in a telephone exchange, dense bundles of jumper wire running between identical terminal blocks.
Photo by Wilhelm Gunkel on Unsplash
  1. Archive/

Hijacking a Prezi Subdomain Redirect ($500)

·1 min
Open redirect URL parsing Phishing Lookalike domain
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

Today I want to share a short story about a bug I found on one of Prezi’s subdomains, mailroom.prezi.com. The web server at http://mailroom.prezi.com is configured to redirect users to the Prezi login page. I found that if you append a domain to the end of the URL — say http://mailroom.prezi.com/.anydomain.example — it redirects to https://mailroom.prezi.com.anydomain.example.

Proof of concept
#

To validate this I registered a subdomain of my own, mailroom.prezi.com.attacker.example. If an attacker hosts a cloned login page there over valid HTTPS, a request to http://mailroom.prezi.com/.attacker.example will redirect the victim to https://mailroom.prezi.com.attacker.example — the attacker-owned domain.

The Prezi wordmark logo

Disclosure
#

This issue was worth a $500 cash reward. The Prezi team, as always, fixed it in less than 24 hours — hats off to a responsive and skilled security team.

Related