{"id":"CVE-2023-36474","aliases":["EUVD-2022-0640","GHSA-m36x-mgfh-8g78","GO-2022-0372"],"status":"published","title":"Interactsh server settings make users vulnerable to Subdomain Takeover","description":"Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00539,"percentile":0.45689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-01-27T15:15:25Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"Go","package":"github.com/projectdiscovery/interactsh","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/projectdiscovery/interactsh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/projectdiscovery/interactsh","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/projectdiscovery/interactsh","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]}],"products":[{"vendor":"projectdiscovery","product":"interactsh"}],"references":[{"url":"https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m36x-mgfh-8g78","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/projectdiscovery/interactsh/issues/136","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/projectdiscovery/interactsh/pull/155","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/","tags":["x_refsource_MISC","x_transferred","Technical Description","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36474","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m36x-mgfh-8g78"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36474.json","tags":["advisory"]},{"url":"https://github.com/projectdiscovery/interactsh","tags":["package"]},{"url":"https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-36474","title":"Interactsh server settings make users vulnerable to Subdomain Takeover","description":"Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.","status":"published","published":"2023-06-28T21:20:22.455Z","modified":"2024-11-06T17:16:00.767Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2022-0640","description":"Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.","status":"published","published":"2023-06-28T21:20:22Z","modified":"2024-11-06T17:16:00Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:05:09.226597Z"}],"ghsa":[{"id":"GHSA-m36x-mgfh-8g78","title":"Subdomain Takeover in Interactsh server","description":"A domain configured with interactsh server was vulnerable to subdomain takeover for specfic subdomain, i.e `app`, Interactsh server before `\u003c 1.0.0` used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default which intended to used for hosting interactsh [web client](https://github.com/projectdiscovery/interactsh-web) using GitHub pages. It turns out to be a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a cname entry pointing to GitHub pages, making them vulnerable to subdomain takeover.\n\nThis issue was initially reported to us as a subdomain takeover for one of our domains that runs interactsh server by **Melih** at `security@projectdiscovery.io`, and after conducting an internal investigation, we determined that it was an issue with the default config of interactsh server affecting all the server running self-hosted instance of interactsh, as a result - cname entry has been removed in the latest release.\n\n#### Impact\nThis allows one to host / run arbitrary client side code (XSS) in a user's browser when browsing the vulnerable subdomain, for more details on the impact, please read this [detailed blogpost](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/) from Detectify.\n#### Patches\nUpdate to [Interactsh server v1.0.0 ](https://github.com/projectdiscovery/interactsh/releases/tag/v1.0.0)with `go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest`\n\n#### References\nhttps://github.com/projectdiscovery/interactsh/issues/136\n\n#### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@projectdiscovery.io](mailto:security@projectdiscovery.io)\n","status":"published","published":"2022-01-27T15:15:25Z","modified":"2023-11-10T05:05:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2023-36474","description":"Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.","status":"published","published":"2023-06-28T22:15:09.503Z","modified":"2026-06-17T06:06:20.6Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:14.715708Z"}],"osv":[{"id":"CVE-2023-36474","title":"Interactsh server settings make users vulnerable to Subdomain Takeover","description":"Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.","status":"published","published":"2023-06-28T21:20:22.455Z","modified":"2026-10-28T02:30:49.603801676Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-m36x-mgfh-8g78","title":"Subdomain Takeover in Interactsh server","description":"A domain configured with interactsh server was vulnerable to subdomain takeover for specfic subdomain, i.e `app`, Interactsh server before `\u003c 1.0.0` used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default which intended to used for hosting interactsh [web client](https://github.com/projectdiscovery/interactsh-web) using GitHub pages. It turns out to be a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a cname entry pointing to GitHub pages, making them vulnerable to subdomain takeover.\n\nThis issue was initially reported to us as a subdomain takeover for one of our domains that runs interactsh server by **Melih** at `security@projectdiscovery.io`, and after conducting an internal investigation, we determined that it was an issue with the default config of interactsh server affecting all the server running self-hosted instance of interactsh, as a result - cname entry has been removed in the latest release.\n\n#### Impact\nThis allows one to host / run arbitrary client side code (XSS) in a user's browser when browsing the vulnerable subdomain, for more details on the impact, please read this [detailed blogpost](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/) from Detectify.\n#### Patches\nUpdate to [Interactsh server v1.0.0 ](https://github.com/projectdiscovery/interactsh/releases/tag/v1.0.0)with `go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest`\n\n#### References\nhttps://github.com/projectdiscovery/interactsh/issues/136\n\n#### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@projectdiscovery.io](mailto:security@projectdiscovery.io)\n","status":"published","published":"2022-01-27T15:15:25Z","modified":"2026-09-10T03:49:10.8229014Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"GO-2022-0372","title":"Subdomain Takeover in Interactsh server in github.com/projectdiscovery/interactsh","description":"Subdomain Takeover in Interactsh server in github.com/projectdiscovery/interactsh","status":"published","published":"2024-08-21T14:30:31Z","modified":"2026-03-03T04:52:09.223807Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}