Uber: Reading Emails in Uber Subdomains

Possibility to read emails from various Uber subdomains. None of the domains exposed were actively being used for Uber email communication to employees or users. Possibility of reading emails sent to certain Uber domains. Link to blog:...

Uber: Can add employee in business.uber.com without add payment method

Dear Uber, I found that modify html from https://business.uber.com/organization/org-id/employees can make I create employee without adding payment method. Step to reproduce: 1. Edit html, remove overlay alert. 2. Create employee in website. Or: Use post form: POST...

Exploit details: change any user of the Uber-password-vulnerability warning-the black bar safety net

Vulnerability status: resolvedclosed Disclosure Time: 2 0 1 6 7 1 5 am 5 points 3 8 points Report objects: Uber Vulnerability type: authentication class Bonus: 1 0 0 0 0$ ! Vulnerability overview: Uber is a global instant car software, the software has now covered the global more than sixty...

Uber: Get organization info base on uuid

Hi Uber, I found issue on https://business.uber.com/server/employees Step to reproduce: 1. Send post request to https://business.uber.com/server/employees: 2. Change userUuid of other user and then see organization info if they has valid organization and their persinol info Best ragards, Severus...

Uber: newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf

Limited disclosure @jamesclyde's request...

Uber: Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com

Limited disclosure at @rojanr's request Subdomains including translate.uber.com, fr.uber.com and de.uber.com were pointing to a CNAME for a site that was not claimed. I was able to claim the site and add any content. For PoC purposes, I showcased my blog on translate.uber.com and de.uber.com...

Uber: Server version disclosure

Hi uber, maybe this is a low risk but i want to report that the nginx and openresty server version are being disclosed. For openresty: Accessing this url: https://chef.uberinternal.com/ will give you an error "502 Bad Gateway" but you can see on the page that the server version was disclose...

Uber: Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains

Limited disclosure at @vivek-p's request...

Get the passenger and the owner of the personal information? This note Uber logical vulnerability“combination punches”worth a look-vulnerability warning-the black bar safety net

! Uber recently finally opened up its vulnerability reward program, and encourage white-hat gate expand on the Uber online service vulnerability mining. Please with FreeBuf xiaobian together look at this a few logical loopholes the formation of“combination of Boxing” it. Information collected...

Uber promo code vulnerability allows hackers a free ride-vulnerability warning-the black bar safety net

! Do you want to by Uber taxi services to travel free? If you are the Uber taxi service loyal users,or you've ever used Uber to call a car service,then this article will definitely make you excited. Because there is a name from the Egypt independent security researcher in the Uber app found a...

HackerOne: Know undisclosed Bounty Amount when Bounty Statistics are enabled.

Hi, When a program does not disclose How much bounty is paid to particular report , but if bounty statics is enabled then undisclosed Bounty Amount can be enumerated. For example Uber does not disclose bounty awarded to particular researcher but show bounty statics so we can write a script that...

Uber Hack lets anyone find Unlimited Promo Codes for Free Uber Rides

An Independent Security Researcher from Egypt has discovered a critical vulnerability in Uber app that could allow an attacker to brute force Uber promo code value and get valid codes with the high amount of up to $25,000 for more than one free rides. Mohamed M.Fouad has discovered a "promo codes...

Uber: Command Injection, Information

Dear Sir, I am going to share information about content spoofing vulnerability present in 404 page. This vulnerability may not consider as in-scope but you can put it as informative. Description : "Content spoofing, also referred to as content injection or virtual defacement, is an attack targeti...

Uber: Server version disclosure: team.uberinternal.com

In the HTTP response header from team.uberinternal.com, the nginx web server version is disclosed. HTTP/1.1 301 Moved Permanently Server: nginx/1.8.1 Date: Tue, 21 Jun 2016 22:45:53 GMT Content-Type: text/html Content-Length: 184 Connection: keep-alive Location: https://team.uberinternal.com/...

Uber: Error Message on 404 page

Hi, I know this is not really...

Uber: Self-XSS in Partners Profile

Hi , I have found an XSS stored vulnerability in the page paterns uber profile edit. the vulnerability in the vat number. Steps to reproduce: 1. Login to partners.uber.com 2. Go to a page https://partners.uber.com/profile/ 3. In the vat number enter a payload xss : " " alert0 4. save thank you,...

Uber: xss in https://www.uber.com

Hey, this vulnerability is essentially the same as bug 145276, i'm reporting it again just in case. there's a cross site scripting vulnerability in https://www.uber.com/. steps to reproduce: 1.visit...

Uber: Bruteforce INVITE codes easy way

As soon as i read the vulnerability disclosed on h1 regarding Possibility to brute force invite codes in riders.uber.com "https://hackerone.com/reports/125505" . I have found similar & easy way to bruteforce invite codes but in different manner . Also, 1680 public invites are waiting for...

Uber: Newsroom.uber HTML form without CSRF protection

Hi, The link that exists CSRF vulnerability https://newsroom.uber.com/india/how-to-refer/ Attack details Form name: Empty Form action: https://newsroom.uber.com/india/wp-login.php?action=postpass&wpe-login=ubernewblog Form method: POST Reproduction Steps 1-Create a file named submit.html 2-Write...

Uber: Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)

Through the endpoint at /rt/users/passwordless-signup it is possible to change the password of any Uber user, given knowledge of their phone number or by just enumerating phone numbers until one is found that is registered with Uber - not too hard given the number of Uber users. I've tested this...