I was asked to ask this as a separate question. This isn't a duplicate question.
Okay, so I asked the above question coz I'm concerned of the following situation:
A domain sets auth cookies to *.target.com as multiple subdomains running different services need auth cookies. Also one such service is xxxx.target.com. Here, I am able to upload files under my sub-subdomain that is I can upload files as myname.xxxx.target.com/myownfilename.extn. Is this vulnerable?
For eg., Lets Encrypt asks to upload a file in /.well-known/acme-challenge/. For my case this isn't possible but I can upload a file like /somefile.extn.
My question is, is /.well-known/acme-challenge/ this path a standard for http file upload verification? Is the target.com vulnerable if I can upload file to /myfile.extn?
Is there any other ways to get the domain verification done in this case to get valid TLS cert?
In short, if a server, say target.com have auth cookies set to *.target.com and also allow users to upload files under target's subdomain but not exactly to /.well-known/acme-challenge/, is this situation vulnerable? Or, should the server be considered safe? I'm more concerned that other CA may have different http file upload verification methods that could put such servers at risk.