Subdomain Takeover through Webflow

[Avileox]

Service name
webflow

Website
https://webflow.com/

Report
https://hackerone.com/reports/399165

Subdomain takeover through webflow is possible but for creating POC you need a paid account because webflow need a paid account for creating subdomains and using web hosting through webflow.

[0xc0ffeee]

This is not vulnerable. I just tried it on an endpoint that was hosted on Webflow and had 404 on both HTTP and HTTPS.

[Avileox]

Thank you for the update, can you please show the initial screenshot of "404" page

[0xc0ffeee]

[Avileox]

I can confirm that it is not vulnerable anymore,
Thanks for keeping us updated.

[PjMpire]

Webflow sites are still vulnerable to takeover so you may want to change this

Just had a report triaged to confirm.

regards

[Avileox]

Can you please share steps to takeover subdomain through webflow.

[PjMpire]

-Create webflow account and upgrade to basic paid option
-Create blank site
-Go to project settings > hosting
-Scroll down to custom domains section and add vulnerable domain

-Signature of takeover is webflow 404 same as OP.

Takeover is not possible when owner parked the custom domain but not published the site. This scenario would still produce a webflow 404 therefore can be marked as edge case.

Regards

[Avileox]

Thank you for the update.

[0xc0ffeee]

Interesting. I had a "404 Not Found" response on a webflow website but I was still not able to complete the takeover.

I would receive the following error: "That domain is already connected to a Webflow site."

Mind sharing more information without disclosing the target? @PjMpire