This article originally appeared in SC Magazine on August 29. 2019.
Starbucks shuttered a subdomain that pointed to an abandoned Azure cloud resource after a security researcher in its bug bounty program discovered it was vulnerable to cross-site script and session hijacking.
The subdomain, svcgatewayus.starbucks.com, “pointed to Microsoft Azure Cloud App [1fd05821-7501-40de-9e44-17235e7ab48b.cloudapp.net] which was no longer registered under Azure,” researcher Patrik wrote in a report on HackerOne, which provides the platform for the Starbucks bug bounty program.
“Unfortunately, these errors aren’t isolated incidents and are more common than they should be. Many web and mobile app operators remain unaware of the third-parties running code in the background,” said Usman Rahim, digital security and operations manager for The Media Trust. “Without continually monitoring their assets, they are blind to domains/sub-domains these assets point to and are therefore unable to mitigate the risk of being compromised.”
Patrik reported the find to Starbucks and received a $2000 bounty.
