Trello: Full Sub Domain Takeover at help.trello.com.

2016-10-06T22:24:29
ID H1:174417
Type hackerone
Reporter dhaval
Modified 2017-02-02T18:18:33

Description

Hey

The subdomain http://help.trello.com./ uses helpscout to host docs While helpscout does not distinguish between help.trello.com. and help.trello.com (Notice trailing dot)

I created a test page and hosted it for help.trello.com. and since DNS entry is already present http://help.trello.com./ now server page controlled by me

Let me know when to delete my account so that you can claim help.trello.com. in helpscout