The following is a scenario for an attack where one website can impersonate another. I am told (including by this answer) that it's impossible, but I would like to understand exactly what prevents it.
Alice uses websites that fetch a trusted JS resource from Bob's server, using HTTPS to prevent MITM attacks. Bob's resource is popular, and he starts to use a CDN to distribute it. Now Alice's browser is making an HTTPS connection to a server belonging to the CDN.
The CDN uses Subject Alternative Names to share a certificate between multiple customers whose sites share an IP address on the CDN. Eve happens to own a site which is on the same certificate as Bob's (1). Eve knows Alice's favourite coffee shop, and can intercept signals on the wifi there.
Since Eve doesn't have the certificate's private key, she can't read Alice's HTTPS traffic. Instead, she waits for a request for the resource on Bob's site (2), and replaces it with a request to her own site, via the same CDN IP address that proxies both sites. The CDN server decrypts the request, fetches a malicious resource from Eve's site, and encrypts that using the shared certificate. Alice's browser sees a valid response from the CDN IP that it sent the request to, and seemingly has no reason not to accept it. Note that Eve doesn't need to modify the response by MITMing - the CDN server sends back the malicious content from a server behind it.
- Or is able to hack into one. One of them is bound to be insecure.
- Is the URL encrypted in an HTTPS request? If so, assume Eve replaces all requests going to the relevant IP address and bets on detection being unlikely.
I'm not especially familiar with SSL, so I'm willing to believe that something in that doesn't hold, but I'm not sure what, exactly.