Uber: OneLogin authentication bypass on WordPress sites

First, I'm sorry about reporting another WordPress bug my intention was just to check if WP-OneLogin stores any sensitive info that could be used to attack OneLogin on your other websites. Overview The .uber.com WordPress sites use OneLogin SAML-SSO instead of the normal WordPress login. The...

Uber: Missing authentication on Notification setting .

Hi , Notification setting link works without cookies so an attacker can steal link from browser histroy and can change notification setting of victim. Notification setting link does not expire even after logout. Steps to reproduce :- 1.Log in as uber rider. 2.Go to profile. 3.Now go to "Manage yo...

Uber: Uber for Business Allows Administrators to Change Uber Driver Ratings Due to Failure to Authenticate `fast-rating` Endpoint

business.uber.com allows administrators to request a copy of a receipt be emailed to them. This email contains a link to https://riders.uber.com/fast-rating which allows for the administrator to change the rating the user submitted for the Uber driver. Furthermore, the link that is supplied does...

Uber: Defect-Security | Driver-Broken Authentication | Able to update the Subscription Setting anonymously

Steps to execute the issue/defect 1:Logged into account on domain https://riders.uber.com with one of the accounts account type-Driver 2:Now go to Manage your email subscription settings and note the link mentioned below -View the subscription setting i.e. subscription setting Uber Global Updates...

Uber: Stored self-XSS at m.uber.com

There is a stored self-XSS vulnerability at m.uber.com in displaying the uber invite code. If the user sets the invite code at alertdocument.domain value using the main personal area at the uber.com and then signs into the m.uber.com the XSS is fired. Possible other user exploitation case can be...

Uber: Reflected XSS via Livefyre Media Wall in newsroom.uber.com

Hello @uber, This vulnerability works in all sites where there Livefyre Media Wall, including newsroom.uber.com. To reproduce this Cross-Site Scripting, visit this URL: https://newsroom.uber.com/?lf-content=danylod.com/uber.php?:131560603:307477931 Vulnerable is this source code:...

Uber: CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```

backup.uber.com hosts a CrashPlan backup server on port 443. CrashPlan allows users to backup to a friends computer by entering a 6 digit alphanumeric code. This means there are 2,176,782,336 total CrashPlan friend codes. While this is a high number, it is completely possible to brute force this ...

Uber: Stored XSS in developer.uber.com

An attacker can make a series of requests to https://uber.readme.io/ that will result in permanent defacement/stored XSS of all the documentation pages on https://developer.uber.com/ I'm not entirely sure if this is in scope, but it could definitely have a major impact on developer.uber.com so I...

Uber: XSS via password recovering

I found that xss can be executed if we provide xss payload as a password in Uber during password recovery. Steps to follow: 1 Goto https://login.uber.com/forgot-password 2 Enter email and submit 3 Open the recover link you got 4 Enter Set password: alertdocument.domain; and submit it 5 Click Show...

Uber: Unsubscribe any user from receiving email

hi, At url https://www.uber.com/unsubscribe you can unsubscribe any email of any user, which is bit of concern for the people who wants to receive emails from uber. only people who gets email from uber should be allowed to unsubscribe themselves from uber emails rather than anybody unsubscribing...

Uber: developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes

Issue You can iframe the error pages for https://developer.uber.com/404 and https://developer.uber.com/docs/404 Proof of concept An example can be found here http://codepen.io/JacobReynolds/pen/VaMbde?editors=1010 Impact There is not a large security impact from a cursory glance at the 404 pages...

Uber: Disclosure of ways to the site root

Hello. Go to this address and you see error with addresses https://trip.uber.com/1% Request GET /1% HTTP/1.1 Host: trip.uber.com Connection: keep-alive Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 Windows NT 6.1;...

Uber: User credentials are not strong on vault.uber.com

I was just trying to login vault.uber.com I entered email xx and password xx, I got loggedin to someones account. I entered email zz and password zz, I got loggedin to someones account. It means passowrd complexity and length of username/email is not enforced. This allowed my to access the someon...

Uber: Information disclosure at lite.uber.com

Hello! 1. At https://lite.uber.com/auth/login I get 302-redirect to https://login.uber.com. 2. After post my email and password I get callback to https://lite.uber.com/auth/callback?code=efopqUAx2uwMOqJafHGj2OP8yNxXkf 3. At this page we can see trace stack with names of nodejs modules, full path...

Uber: Easy spam with USE My PHONE Feature

By this Bug we can easily spam anyone's phone with Uber Sms We just need to use his/her phone number while registration and Open https://partners.uber.com/dashboard/documents/ so we have 2 option 1st is upload and 2nd is Send Sms on phone so we can spam anyone's phone by using sms feature you...

Uber: Session Impersonation in riders.uber.com

Steps: First log in as attacker in riders.uber.com. Victim now opens https://login.uber.com/login in same browser eg: net cafe. It asks you to enter login credentials even though another session is alive. If victim enters his account credentials, he will be taken to riders site. Even though rider...

Uber: Possibility to get private email using UUID

Given the UUID of a user it was possible to get their email address by passing in their UUID via POST to /support/tickets inside of the token parameter...

Uber: Possible to View Driver Waybill via Driver UUID

Due to an access control vulnerability it was possible to view the waybill of an arbitrary driver/partner by supplying their UUID to the /rt/drivers/DRIVERPARTNERUUID/waybill endpoint...

Uber: Use Partner/Driver App Without Being Activated

This report is a duplicate of 126260 and allows for someone who is not an activated Driver/Partner to log into the Uber Partner app. As stated in 126260 this doesn't allow you to Go Online but does allow you to see how the app functions as if you were a driver/partner...

Uber: Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber Drivers

m.uber.com has an endpoint at https://m.uber.com/proxy-rt/product/city/rider-view that when called will return a list of nearby vehicles. By iterating through all latitudes and longitudes, it is possible to count the total number of active Uber drivers. The full URL to be called is...