Modern Front End, Ancient Back Office: Auditing A Hybrid Estate

TL;DR: A modern framework on the main domain, an ancient content system on a raw origin behind it. I audited both estates separately, and the legacy side defined the risk. Here is how to see your own other era.

The scenario

I ran this as a black-box review: no credentials, only the publicly visible surface. Here is what I saw before I touched anything.

A nonprofit participation platform serving a modern pre-rendered application on the primary domain and a legacy content system on a subdomain behind an unprotected origin server, with several third-party services. Assessment covered both estates separately, mail authentication, header policy and third-party script inventory.

I removed all identifying information. The target is described only by sector and technology class so the pattern can be reused.

The pattern

The pattern I recognised — and that I keep finding in similar estates:

Hybrid estates are the norm for anything that has been through a redesign, a rebrand or a merger, and they create a specific governance failure: the modern surface has an owner who reviews it, and the legacy surface has a hostname that nobody owns. The legacy system survives because it still serves something, and what it serves is usually an archive, a newsletter landing page or a subdomain someone forgot was still live.

The technical contrast makes it worse. The modern side sits behind a global content delivery network with automatic certificate management, and every security header in the estate is applied there because that is where the configuration file lives. The legacy side sits on a raw origin with its own server software, its own content management release and none of those protections, and it is reachable at a predictable subdomain. An attacker enumerating subdomains finds it in minutes.

The lesson generalises past content management systems. When an estate has two eras of technology, the question to ask is not which one is better but which one nobody is looking at. That answer determines the remediation order, and it is almost never the one that is technically most interesting.

Findings

The attack path

Reproduction in my lab

Every command below targets a lab container I control. Nothing here is aimed at a live system.

Find the other era on your own estate

# what technology answers each host
$ for h in example.org legacy.example.org archive.example.org cms.example.org; do
    printf '%-26s %s %s\n' "$h" \
      "$(curl -so /dev/null -w '%{http_code}' https://$h/)" \
      "$(curl -s https://$h/ | grep -oiE 'generator[^>]*content="[^"]+"' | head -1)"
done

# does the legacy host carry any protection
$ curl -sI https://legacy.example.org/ \
  | grep -icE 'strict-transport|content-security-policy|x-frame-options|x-content-type'

Detection in your own estate

Enumerate subdomains on a domain you own

$ for sub in www legacy archive cms old blog admin shop help intranet; do
    printf '%-12s %s\n' "$sub" "$(dig +short "$sub.example.org" | tr '\n' ' ')"
done

# then look at certificate transparency for what exists
$ dig +short TXT example.org | grep -i spf

Remediation

Put the same perimeter in front of every host, including legacy ones

# the modern CDN config is not the estate config unless every host is behind it
# for a legacy host, at minimum put an origin-level shield in front
server {
    listen 443 ssl http2;
    server_name legacy.example.org;

    # same baseline as the modern surface
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # and never expose the content management version
    server_tokens off;
    proxy_hide_header X-Powered-By;
}

Takeaways

• The estate is only as protected as its least-owned hostname.
• A CDN on the primary domain is not a perimeter for the subdomain.
• Archive systems survive because someone still uses them; that is a decommission decision.
• Enumerate subdomains first. The other era is always on a predictable name.