Today I want to share a short story about a bug I found on one of Prezi’s subdomains, mailroom.prezi.com. The web server at http://mailroom.prezi.com is configured to redirect users to the Prezi login page. I found that if you append a domain to the end of the URL — say http://mailroom.prezi.com/.anydomain.example — it redirects to https://mailroom.prezi.com.anydomain.example.
Proof of concept#
To validate this I registered a subdomain of my own, mailroom.prezi.com.attacker.example. If an attacker hosts a cloned login page there over valid HTTPS, a request to http://mailroom.prezi.com/.attacker.example will redirect the victim to https://mailroom.prezi.com.attacker.example — the attacker-owned domain.
Disclosure#
This issue was worth a $500 cash reward. The Prezi team, as always, fixed it in less than 24 hours — hats off to a responsive and skilled security team.
