How is a DNS wildcard a security issue for GitHub Pages?

Question

GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so:

• GitHub must be set up to recognize that an incoming call referred to by a non-GitHub domain should be handled
• the personal domain must have a pointer to GitHub, via a CNAME in the domain's zone

At some point in the documentation, there is a fat warning:

(EDIT: I updated the example below to a more complete zone following Steffen's answer because I do not understand it)

Let's say that I own example.com and the public IP 150.1.1.1, and I have a wildcard DNS entry:

*.example.com. IN CNAME hello.example.com.
hello.example.com. 300 IN A 150.1.1.1
mypageongithub.example.com. IN CNAME myuser.github.io.

In other words, something not otherwise defined in my example.com zone points to hello.example.com.

How can this present a danger of someone using my domain to advertise their GitHub page?

Note: I posted the question in Information Security rather than superuser.com or another similar site as this is more about identity theft (or misrepresentation) than a technical question about DNS

Answer 1

*.example.com. IN CNAME hello.example.com.

A CNAME is resolved in the client to finally get the IP address. This means Github is not aware that you have a CNAME for *.example.com and that whatever.example.com resolves to hello.example.com using this CNAME. All it knows is that somebody wants to access whatever.example.com since this is the name used to access a github.io IP address.

If your <user>.github.io is only mapped to the name hello.example.com then somebody else could create a different <user2>.github.io page and map it to another-hello.example.com. Both domains resolve in the same target IP address (due to the CNAME) but one will show the contents of <user>.github.io while the other will show the contents of <user2>.github.io.

Note that this only relevant if you map all subdomains to github.io using a wildcard - as it seemed to be from your original question. After the edit of the question it came clear that there is only a single name mapped to <user>.github.io and that the wildcard is used for domains which don't map to Github. This is fine and this is also not was Github warned against when reading the warning in the context it was originally published.

Answer 2

Following the discussion in comments, the warning of GitHub is against DNS entries such as

*.example.com IN CNAME someuser.github.io

This is a case where someone would use example.com as the baseline for several pages at GitHub and would not be willing to name them all one by one.

In such a case, since someuser.github.io ultimately points to a set of IPs in GitHub (someuser.github.io does not have a dedicated IP), then a malicious user could piggy-back on example.com to point to their page.

The example in my question where the wildcard points to a host in example.com is not a problem.

Personal comment: the warning is in a scary red box and should be made IMO more explicit (by GitHub)