Card Declined? So Was Your Subdomain | Featurebase as an Undercovered Subdomain Takeover Vector

Featurebase is an SaaS designed to help companies and enterprise corporations effectively deal with customer support and allow for an easy method for users to provide feedback.

In Featurebase settings, developers have the convenient option to serve Featurebase pages on their own domain under a feedback.[domain].com (default) or under a different named subdomain, given they have a premium, paid Growth or higher plan or free Growth trial.

The trial plan does not require a credit card and lasts for 10 days (this will be important later).

A typical Featurebase deployment process on a custom domain looks like the following:

1. The customer adds a CNAME record in their DNS pointing their subdomain at customdomains.featurebase.app.
2. Traffic to that subdomain resolves via the CNAME to Featurebase's infrastructure (Cloudflare edge).
3. During the TLS handshake, the browser sends an SNI extension declaring the hostname. Cloudflare uses this to select the correct certificate for that domain.
4. Featurebase provisions that certificate automatically via Cloudflare when the domain is registered in Settings → Custom Domains.
5. Once TLS is established, the HTTP request reaches Featurebase's origin. Featurebase reads the Host header and looks up which organization has registered that domain.
6. If a registration exists, Featurebase serves that organization's content.

Now here's the interesting part: Featurebase makes NO attempt to verify domain ownership whatsoever through methods such as a TXT record challenge (as Google Search Console or similar services require).

This is classic Insecure Design business logic from Featurebase.

As a result, Featurebase exposes users to classic subdomain takeover incidents.

Should a user:

1. Register on Featurebase & create a paid Growth or higher plan
2. Point at their custom domain
3. Fail to renew their plan and fail to remove their CNAME

Featurebase will immediately strip the organization's ownership in their database of the subdomain and leave a unique fingerprint, shown below.

As seen in DevTools, Featurebase will make repeated attempts to resolve which organization owns the domain by polling /api/v1/organization.

Finding none registered, each request returns the unique {"message": "Organization not found", "success": false} with a 404, causing the SPA to loop indefinitely.

This creates a classic subdomain takeover vulnerability via orphaned domain whereby:

1. An attacker creates a featurebase account, either paying for a Growth or higher plan or opting for the convenient no credit card free trial.
2. Attacker points custom domains at the victim's dangling CNAME record on their subdomain.
3. Featurebase faithfully confirms that a CNAME exists, without verifying ownership, and begins serving the attacker's content.

Confirming Featurebase Subdomain Takeover

In addition to the fingerprints noted above, reports for Featurebase subdomain takeover should show the following:

Proof of CNAME record existence

dig CNAME [featurebase_subdomain].[target].com | grep customdomains.featurebase.app

dig CNAME [featurebase_subdomain].[target].com | grep customdomains.featurebase.app

Proof of a 404 organization API return

curl -s https://feedback.yourdomain.com/api/v1/organization

curl -s https://feedback.yourdomain.com/api/v1/organization

And, if in-scope, a successful takeover with innocent content.

Just like genuine attackers, researchers can utilize Featurebase's free Growth plan trial for free to prove takeover for programs and clients.

I have personally tested this against a real production environment under scope with disclosure for a bounty.

Don't Become A Victim

Subdomain takeover is much more significant than CVSS scores and many writeups make it out to be.

A smart attacker with a controlled subdomain on a live host can:

• Bypass Cloudflare and WAF protections
• Launch and exploit XSS
• Launch extremely convincing phishing campaigns under domain legitimacy
• Launch cookie injection attacks.
• Intercept OAuth and SSO flows.
• Exploit CORS misconfigurations.

If you are a web developer deploying Featurebase, make SURE you are monitoring your subdomain and plan. If the plan cancels, your subdomain is up for grabs.

Make sure you're properly auditing your dependencies, limiting subdomain exposure to strictly necessary groups, and wiping unused subdomains and their CNAME.

To date, Featurebase has NOT been submitted to the industry standard can-I-take-over-xyz, but it appears the repository has been abandoned given last contribution being 1 year ago.

This article serves as reference and a gift to the security community for researchers who encounter orphaned Featurebase domains.