392 matches found
Uber: Open redirect on rush.uber.com, business.uber.com, and help.uber.com
@4lemon reported open redirects on rush.uber.com, business.uber.com, and help.uber.com which would have made it possible for an attacker to redirect a victim through to another arbitrary site without user interaction...
Uber: Cross-site Scripting (XSS)
The website located at https://login.uber.com/applications suffers from a stored Cross-site Scripting XSS vulnerability. Reproduction Steps: Create a new application with name as the following vector, and try to delete the same app. Vector : " Note that the XSS payload has fired. Possible...
Uber: uber.com may RCE by Flask Jinja2 Template Injection
Hi, Uber Security Team I found an RCE in rider.uber.com. First, if you change your profile name to '7'7 , and you will receive a mail "Your Uber account information has been updated" sent by [email protected] And in mail body, you can see your name become '7777777' This is a vulnerability about...
Uber: SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/
The Wordpress blog located at https://drive.uber.com/frmarketplace/ had a plugin called Huge IT Video Gallery which suffered from an SQL injection vulnerability. While this site did not contain customer information, the vulnerability could be possibly used to deface the Wordpress blog or extract...
Uber: Reflected XSS via Unvalidated / Open Redirect in uber.com
Hello, To reproduce this issue, visit this URL: https://www.uber.com/en//example.com/ This URL will redirect at example.com...
Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App
Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...
Uber: Session retention is present which reveals the customer info
Issue : Session retention is present at partner.uber.com which reveals all senstive data Steps to reproduce : 1Login to partner.uber.com under any driver profile 2navigate to summary page or any page e.g payment page 3logout the application 4press back button of the application application reveal...
Uber: Brute Force Amplification Attack
The websites on following hosts - newsroom.uber.com - eng.uber.com - brand.uber.com are vulnerable to Wordpress Brute Force Amplification Attack where an attacker can try a large number of Wordpress usernames and password login combinations in single HTTP request more at...
Uber: CSRF on eng.uber.com may lead to server-side compromise
The site eng.uber.com uses a WordPress plugin called Fluid Responsive Slideshow. The plugin doesn't implement any CSRF check for AJAX requests. Some of these AJAX requests can be used to modify posts and pages on the system. An attacker could use this bug to inject arbitrary JavaScript in any pag...
Uber: Possibility to brute force invite codes in riders.uber.com
When adding new promotion codes for free rides, one could brute force invitation codes since there is no protection against brute force attacks. When going to payment page, it's possible to apply promotion code. If we intercept this request, we can brute force codes, since there is no captcha or...
Uber: Stored Cross Site Scripting [SELF] in partners.uber.com
Hey Uber Team, although you are excluding self stored XSS i am reporting this one because it could be exploited by someone with more skills then i have :- : 1. Login to your profile and change the address to : “ 2. Go to https://partners.uber.com/fuelcards/enroll 3. The JS will pop up best Patrik...
Uber: Dom Based Xss
Hi. found dom xss on this subdomain eng.uber.com. you are using a vulnerable plugin prettyPhoto.. This XSS will work in Firefox,Chrome - Google and IE last version ! And this is very dangerous! POC Firefox vector http://eng.uber.com/prettyPhotoi/x,/x POC Google and IE...
Uber: Estimation of a Lower Bound on Number of Uber Drivers via Enumeration
@ddworken discovered a way to estimate a lower bound on the number of Uber drivers via an endpoint with low entropy. Thanks for the report @ddworken! Good summary from @Uber, just wanted to clarify that we are sticking to limited disclosure since this issue was only patched moving forward so not...
Uber Bug Bounty Rewards Loyalty, Promises Transparency
Uber’s bug bounty program emerged from private beta mode yesterday, which it used as a feedback forum for participants in order to develop the public program. “This was pretty unique in its approach,” said HackerOne CTO Alex Rice. Uber’s program is built on the HackerOne platform, and Uber...
Uber: Avoiding Surge Pricing
Please have a look at the video in this video link which shows the bug and helps you reproduce the same following the steps. As you can see, there is surge of 1.3x in that area. But with this bug, one can avoid the surge. To explain the video in brief First I selected Uber Go with the pickup...
Uber: Create account in uber without signup form
Issue : We can able to signup new users without filling the signup form /we can easily insert the same record with multiple email id and phone numbers Impact : Uber have many offers for new signed users,this can be used to spam/create as many users as they want ,uber doesnt validate the parameter...
Uber: Bypassing Uber Partner's 3 Cancel Limit
The Uber Partner app was supposed to log you out of the app if you cancel three requests in a row, temporarily denying the Partner the ability to go online. This report detailed the ability to bypass that limitation...
Uber: Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers
Invite codes are 5 alphanumeric lower case characters. This means there are 36 26 + 10 possible options for each space in the invite code. In total this means there are 36^5 or 60,466,176 possible invite codes. Through enumerating through all possible invite codes, one can find the total number o...
Uber: Full path disclosure on track.uber.com
The page at track.uber.com had verbose stack traces enabled, allowing an attacker to learn information about the libraries, technologies and system information used in Uber Rush. Thanks, @firs0v!...