Interactsh server settings make users vulnerable to Subdomain Takeover
CVE-2023-36474

8.2HIGH

Key Information:

Vendor: Projectdiscovery
Status: Interactsh
Vendor: CVE Published:; 28 June 2023

🔔 Create Projectdiscovery Vulnerability Alert

What is CVE-2023-36474?

Interactsh, an open-source tool for detecting out-of-band interactions, has a vulnerability that allows subdomain takeover for the specific subdomain 'app.' Prior to version 1.0.0, Interactsh servers utilized default CNAME entries pointing to GitHub pages, which could lead to arbitrary client-side code execution through cross-site scripting when users visit the vulnerable subdomain. This risk occurs if users fail to configure a web client while having a CNAME entry set up. The issue has been resolved in version 1.0.0, which makes CNAME configurations optional.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch