Uber: ability to retrieve a user's phone-number/email for a given inviteCode

The www.uber.com/a/join?invitecode=inviteCode endpoint returned email and/or phone number for the user with the invite code inviteCode. Since protecting our users data is our top priority, we were very interested in this report. It was also a pleasure to work with @kushal89shah and we look forwar...

Uber: SMS/Call spamming due to truncated phone number

Due to improperly validation of phone numbers during the Android Rider sign-up, it was possible to spam a phone number with verification calls and texts. By inputting an 11 or 12 digit phone number, it would be truncated to 10 digits, resulting in the same number from varying inputs...

Uber: Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront

Hi, 3 hours ago, rider.uber.com was responding like this: F127137 This happened on both HTTP and HTTPS. Now, as our blog post from last week says: https://labs.detectify.com/2016/10/05/the-story-of-ev-ssl-aws-and-trailing-dot-domains/ This means that there's a high chance this domain does not hav...

Uber: private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events

This report highlighted that the Uber Driver app did not anonymize the last name and phone number of the rider...

Uber: password reset token leaking allowed for ATO of an Uber account

With an email address for a valid Uber account, it was possible to take over that account because the reset token was exposed in the response of a password reset HTTP request. This meant an attacker could initiate password reset for an account and immediately receive the reset token for that...

Uber: Users can falsely declare their own Uber account info on the monthly billing application

When applying for monthly billing, statistics and data regarding account usage that was fetched and subsequently submitted could be tampered with. This data would be reviewed by a human making a credit decision, potentially influencing their decision inappropriately in favor of the applicant. Whe...

The value of a million dollars of vulnerability can be read Uber's internal mail-vulnerability warning-the black bar safety net

! Overview It is understood, Uber site system and broke a vulnerability, an attacker or exploit the vulnerability feel free to read Uber's internal mail. And according to Uber, the company's vulnerability reward program, the vulnerability of the value of about one million dollars. Write in front ...

Reading Uber’s Internal Emails [Uber Bug Bounty report worth $10,000]

After recent finding about one of the Uber’s subdomain takeover was publicly disclosed, I looked into Uber to find similar bugs. One of my colleagues Abhibandu Kafle, pointed out that em.uber.com also had CNAME pointing to SendGrid and could be vulnerable to similar kind of issue. I had limited...

Uber: Lack of payment type validation in dial.uber.com allows for free rides

When a rider account had an outstanding account balance, improper validation of the payment method ID provided in the request made it possible to use an invalid payment method. As a result, it was possible to provide a non-existent payment type ID such as xyz when requesting a ride and get the tr...

eats.uber.com XSS vulnerability

Vulnerable URL: https://eats.uber.com/unavailable?latLng=54.5602519%2C-6.026832900000045="alert/OPENBUGBOUNTY/...

Uber: Reading Emails in Uber Subdomains

Possibility to read emails from various Uber subdomains. None of the domains exposed were actively being used for Uber email communication to employees or users. Possibility of reading emails sent to certain Uber domains. Link to blog:...

Uber: Can add employee in business.uber.com without add payment method

Dear Uber, I found that modify html from https://business.uber.com/organization/org-id/employees can make I create employee without adding payment method. Step to reproduce: 1. Edit html, remove overlay alert. 2. Create employee in website. Or: Use post form: POST...

Exploit details: change any user of the Uber-password-vulnerability warning-the black bar safety net

Vulnerability status: resolvedclosed Disclosure Time: 2 0 1 6 7 1 5 am 5 points 3 8 points Report objects: Uber Vulnerability type: authentication class Bonus: 1 0 0 0 0$ ! Vulnerability overview: Uber is a global instant car software, the software has now covered the global more than sixty...

Uber: Get organization info base on uuid

Hi Uber, I found issue on https://business.uber.com/server/employees Step to reproduce: 1. Send post request to https://business.uber.com/server/employees: 2. Change userUuid of other user and then see organization info if they has valid organization and their persinol info Best ragards, Severus...

Uber: newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf

Limited disclosure @jamesclyde's request...

Uber: Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com

Limited disclosure at @rojanr's request Subdomains including translate.uber.com, fr.uber.com and de.uber.com were pointing to a CNAME for a site that was not claimed. I was able to claim the site and add any content. For PoC purposes, I showcased my blog on translate.uber.com and de.uber.com...

Uber: Server version disclosure

Hi uber, maybe this is a low risk but i want to report that the nginx and openresty server version are being disclosed. For openresty: Accessing this url: https://chef.uberinternal.com/ will give you an error "502 Bad Gateway" but you can see on the page that the server version was disclose...

Uber: Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains

Limited disclosure at @vivek-p's request...

Get the passenger and the owner of the personal information? This note Uber logical vulnerability“combination punches”worth a look-vulnerability warning-the black bar safety net

! Uber recently finally opened up its vulnerability reward program, and encourage white-hat gate expand on the Uber online service vulnerability mining. Please with FreeBuf xiaobian together look at this a few logical loopholes the formation of“combination of Boxing” it. Information collected...

Uber promo code vulnerability allows hackers a free ride-vulnerability warning-the black bar safety net

! Do you want to by Uber taxi services to travel free? If you are the Uber taxi service loyal users,or you've ever used Uber to call a car service,then this article will definitely make you excited. Because there is a name from the Egypt independent security researcher in the Uber app found a...