Without making the question too general, I am looking to discover the specific risks associated with cookies between my primary domain hosting HTML content only, to a subdomain that is hosting Hubspot, a Web-based CMS.
Consider I have the following sites:
//Main site - uses HTML only, no server side languages for security example.com //Uses Hubspot and has Hubspot associated cookies, PHP etc. downloads.example.com //Our central order processing and management system (the key asset) - uses various server-side technologies e.g. Java internal.example.com
What I'm looking to discover is if we need to host the Hubspot site elsewhere, or if it safe to host it at downloads.example.com, without creating security implications for internal.example.com.
Specifically, the kind of risks I have been looking at are:
- XSS attack on downloads.example.com could create a malicious cookie, shared with internal.example.com
- Download files on downloads.example.com could be altered by a hacker to contain damaging viruses and programs.
So the question is, does the Hubspot site at downloads.example.com, create vulnerabilities for the other sites (even all servers are hosted separately)?