Deriv.com: Mailgun subdomain takeover

Summary:

I have found an unclaimed subdomain of deriv.cloud. Which is successfully claimable.

Platform(s) Affected:

email.mailgun.deriv.cloud

Steps To Reproduce:

You just need a mailgun account and the you can successfully claim this domain.

Supporting Material/References:

https://hackerone.com/reports/819309

Impact

Summary:

This subdomain takeover is very similar to other subdomain takeovers with just a few key differences:

1. This will allow any user to use a free mail system. This can be very effective while phishing.
2. Can reveal some very sensitive internal information about the Company which can lead to reputation and financial damage.