Uber: It is possible to re-rate a driver after a very long time

Hi It is not possible to edit your rating but there is a way to bypass that restriction Steps: 1- login to your uber account https://riders.uber.com 2- View your trips https://riders.uber.com/trips 3- choose one of your trips 4- click on resend 5- check your email 6- you will find a button in ema...

Uber: Pixel flood attack in https://riders.uber.com/profile

Hi, It is the exact issue described here: https://hackerone.com/reports/390 Where uploading lottapixel.jpg it causes your service to time out HTTP/1.1 504 Gateway Time-out Server: nginx Date: Wed, 30 Mar 2016 02:29:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 13928 Connection:...

Uber: Disclosure of ip addresses in local network of uber

Hi, i have found several DNS records at Google DNS server 8.8.8.8 pointing to Uber local servers: ▶ nslookup logs.uber.com Server: 8.8.8.8 Address: 8.8.8.853 Non-authoritative answer: Name: logs.uber.com Address: 10.6.0.1 ▶ nslookup kerberos.uber.com Server: 8.8.8.8 Address: 8.8.8.853...

Uber: SMS Flood with Update Profile

SMS will send when user update the profile and keep updating the user profile will result in keep sending the SMS, Step to reproduce 1. Login to https://riders.uber.com 2. Go to https://riders.uber.com/profile 3. Update the Account Information, any field for Example FirstName 4. A SMS wil be...

Uber: Changing Driver Passwords With Only an Authenticated Session (no password, no email)

It is possible to completely take over a driver's account with only an authenticated session. If a driver is logged on and wants to change their password, they will be asked for their current password changePassword.png, but when they want to change their email, they are not asked for their curre...

Uber: Uploading Plain Text to uber-documents.s3.amazonaws.com Through the Driver Document Upload Page

Hi, When a new driver is registering on Uber, they have to upload a variety of files proof of insurance, ID, etc. When these files are being uploaded, Uber.com only checks whether the files have the correct extension. This means that one can upload a plain text file with a .png extension and it...

Uber: Uber password reset link EMAIL FLOOD

Step to reproduce Uber password reset link EMAIL FLOOD POC Video https://youtu.be/PPJkOEo6Mw 1. Used OWSAP ZAP Proxy 2. Generated the forgotten password Link of my account [email protected] 3. Used ZAP to replay the packet 4. The Number of replay resulting into number of password link email...

Uber: text injection in get.uber.com/check-otp

Text Injection no HTML or JS in a landing page on get.uber.com...

Uber: XSS In archive.uber.com Due to Mime Sniffing in IE

archive.uber.com hosts a mirror of pypi at archive.uber.com/pypi/simple/. It mirrors all of the .tar.gz that are uploaded to pypi. The MIME type of all the .tar.gz files is application/octet-stream. Since the MIME type is not specified, browsers will automatically try to determine the type of the...

Uber: CSV Injection in business.uber.com

business.uber.com allows for names to begin with an = which allows for injection of formulas into the downloaded CSVs. I wasn't quite sure what to categorize this as since there are two main problems with allowing injection of formulas into a CSV: 1. It allows for data exfiltration through...

Uber: Open redirect on rush.uber.com, business.uber.com, and help.uber.com

@4lemon reported open redirects on rush.uber.com, business.uber.com, and help.uber.com which would have made it possible for an attacker to redirect a victim through to another arbitrary site without user interaction...

Uber: Cross-site Scripting (XSS)

The website located at https://login.uber.com/applications suffers from a stored Cross-site Scripting XSS vulnerability. Reproduction Steps: Create a new application with name as the following vector, and try to delete the same app. Vector : " Note that the XSS payload has fired. Possible...

Uber: uber.com may RCE by Flask Jinja2 Template Injection

Hi, Uber Security Team I found an RCE in rider.uber.com. First, if you change your profile name to '7'7 , and you will receive a mail "Your Uber account information has been updated" sent by [email protected] And in mail body, you can see your name become '7777777' This is a vulnerability about...

Uber: SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/

The Wordpress blog located at https://drive.uber.com/frmarketplace/ had a plugin called Huge IT Video Gallery which suffered from an SQL injection vulnerability. While this site did not contain customer information, the vulnerability could be possibly used to deface the Wordpress blog or extract...

Uber: Reflected XSS via Unvalidated / Open Redirect in uber.com

Hello, To reproduce this issue, visit this URL: https://www.uber.com/en//example.com/ This URL will redirect at example.com...

Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...

Uber: Session retention is present which reveals the customer info

Issue : Session retention is present at partner.uber.com which reveals all senstive data Steps to reproduce : 1Login to partner.uber.com under any driver profile 2navigate to summary page or any page e.g payment page 3logout the application 4press back button of the application application reveal...

Uber: Brute Force Amplification Attack

The websites on following hosts - newsroom.uber.com - eng.uber.com - brand.uber.com are vulnerable to Wordpress Brute Force Amplification Attack where an attacker can try a large number of Wordpress usernames and password login combinations in single HTTP request more at...

Uber: CSRF on eng.uber.com may lead to server-side compromise

The site eng.uber.com uses a WordPress plugin called Fluid Responsive Slideshow. The plugin doesn't implement any CSRF check for AJAX requests. Some of these AJAX requests can be used to modify posts and pages on the system. An attacker could use this bug to inject arbitrary JavaScript in any pag...

Uber: Possibility to brute force invite codes in riders.uber.com

When adding new promotion codes for free rides, one could brute force invitation codes since there is no protection against brute force attacks. When going to payment page, it's possible to apply promotion code. If we intercept this request, we can brute force codes, since there is no captcha or...