392 matches found
Uber: SMS URL verification link does not expire on phone number change and lacks rate limiting
When verifying your phone number attached to your Uber account, it was possible to re-use an old verification URL to validate a new cell phone number. In addition to this, there was no rate limiting on the SMS verification which allowed for it to be easily brute-forced. The internal team resolved...
Uber: Subdomain takeover at signup.uber.com
The domain signup.uber.com was pointing to an unclaimed Netlify domain, allowing an attacker to take over the subdomain. We remediated this issue by deleting the CNAME record from our DNS. Thanks, @ak1t4! Another great TKO - thanks UBER!...
Uber: lert.uber.com: Few default folders/files of AURA Framework are accessible
There were a few default folders/files of the AURA Framework accessible on lert.uber.com. The specified files/folders in the AURA framework were supposed to be accessible, so we did not make any changes here. However, we do appreciate the time taken to submit this report and are disclosing per th...
Uber: IDOR on partners.uber.com allows for a driver to override administrator documents
An IDOR in the /p3/drivers/uploadDocument endpoint on partners.uber.com allowed a driver to upload and overwrite documents for other drivers on a multi-driver account. In addition to this, there was an access control issue where a driver account could also upload and overwrite documents for the...
Uber: Reflected XSS in lert.uber.com
Due to a lack of input validation from the search field on lert.uber.com, it was possible to obtain a Reflected XSS from the URL path, e.g. https://lert.uber.com/s/search/All/Home"PAYLOAD. Thanks, @hussain0x3c!...
Uber: Authorization issue in Google G Suite allows DoS through HTTP redirect
The combination of an authorization flaw in Google’s G Suite and a misconfiguration on Uber’s behalf, allowed @uranium238 to set up an HTTP redirect for the domain ubereats.com. For some UberEats customers, this resulted in not being able to use the service for a short period of time. @uranium238...
Uber Now Tracks Your Location Even After Your Ride
Uber was in controversies at the mid of this year for monitoring the battery life of its users, as the company believed that its users were more likely to pay a much higher price to hire a cab when their phone's battery is close to dying. Uber is now tracking you even when your ride is over, and,...
Uber fix three vulnerabilities, the white hat won thousands of dollars in rewards including vulnerability analysis-vulnerability warning-the black bar safety net
Security expert Kevin Roh on Uber's online APP Uber Central found three vulnerabilities that may cause user data leakage. Uber timely fixes three vulnerabilities, and in Uber's vulnerability Bounty program to reward Kevin Roh thousands of dollars. Uber Central Uber Central services to year 7 on...
Uber Portal Leaked Names, Phone Numbers, Email Addresses, Unique Identifiers
A series of vulnerabilities in UberCENTRAL, a portal Uber started during the summer to help businesses facilitate rides for customers, could have leaked the names, phone numbers, email addresses, and unique ID of all Uber users. Kevin Roh, a student who actively hunts for bugs in his spare time,...
HackerOne in the third quarter TOP 5 vulnerability report-vulnerability warning-the black bar safety net
Foreword HackerOne in the third quarter TOP 5 vulnerability reports are coming announced. In this season, we participated in the Vegas hacker conference, hosted Hacked the World, and in the Reddit discussion above, some of the HackerOne problem. HackerOne vulnerability report from platform to...
Uber: ability to retrieve a user's phone-number/email for a given inviteCode
The www.uber.com/a/join?invitecode=inviteCode endpoint returned email and/or phone number for the user with the invite code inviteCode. Since protecting our users data is our top priority, we were very interested in this report. It was also a pleasure to work with @kushal89shah and we look forwar...
Uber: SMS/Call spamming due to truncated phone number
Due to improperly validation of phone numbers during the Android Rider sign-up, it was possible to spam a phone number with verification calls and texts. By inputting an 11 or 12 digit phone number, it would be truncated to 10 digits, resulting in the same number from varying inputs...
Uber: Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront
Hi, 3 hours ago, rider.uber.com was responding like this: F127137 This happened on both HTTP and HTTPS. Now, as our blog post from last week says: https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trailing-dot-domains/ This means that there's a high chance this domain does not hav...
Uber: private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events
This report highlighted that the Uber Driver app did not anonymize the last name and phone number of the rider...
Uber: password reset token leaking allowed for ATO of an Uber account
With an email address for a valid Uber account, it was possible to take over that account because the reset token was exposed in the response of a password reset HTTP request. This meant an attacker could initiate password reset for an account and immediately receive the reset token for that...
Uber: Users can falsely declare their own Uber account info on the monthly billing application
When applying for monthly billing, statistics and data regarding account usage that was fetched and subsequently submitted could be tampered with. This data would be reviewed by a human making a credit decision, potentially influencing their decision inappropriately in favor of the applicant. Whe...
The value of a million dollars of vulnerability can be read Uber's internal mail-vulnerability warning-the black bar safety net
! Overview It is understood, Uber site system and broke a vulnerability, an attacker or exploit the vulnerability feel free to read Uber's internal mail. And according to Uber, the company's vulnerability reward program, the vulnerability of the value of about one million dollars. Write in front ...
Reading Uber’s Internal Emails [Uber Bug Bounty report worth $10,000]
After recent finding about one of the Uber’s subdomain takeover was publicly disclosed, I looked into Uber to find similar bugs. One of my colleagues Abhibandu Kafle, pointed out that em.uber.com also had CNAME pointing to SendGrid and could be vulnerable to similar kind of issue. I had limited...
Uber: Lack of payment type validation in dial.uber.com allows for free rides
When a rider account had an outstanding account balance, improper validation of the payment method ID provided in the request made it possible to use an invalid payment method. As a result, it was possible to provide a non-existent payment type ID such as xyz when requesting a ride and get the tr...
