vercel-takeover.yaml is a false positive template

[pich4ya]

Nuclei Version:

v3.2.9

Template file:

http/takeovers/vercel-takeover.yaml

Command to reproduce:

nuclei vulnerable.domain
[...]
[vercel-takeover] [http] [high] https://example.vulnerable.domain

Anything else:

The Vercel domain takeover is not possible anymore without the ability to add/modify DNS record of a victim domain.

Vercel has added Domain verification with DNS TXT record "_vercel" https://vercel.com/docs/projects/domains/add-a-domain#configure-the-domain as discussed in EdOverflow/can-i-take-over-xyz#183.