Uber: Stored Cross Site Scripting [SELF] in partners.uber.com

Hey Uber Team, although you are excluding self stored XSS i am reporting this one because it could be exploited by someone with more skills then i have :- : 1. Login to your profile and change the address to : “ 2. Go to https://partners.uber.com/fuelcards/enroll 3. The JS will pop up best Patrik...

Uber: Dom Based Xss

Hi. found dom xss on this subdomain eng.uber.com. you are using a vulnerable plugin prettyPhoto.. This XSS will work in Firefox,Chrome - Google and IE last version ! And this is very dangerous! POC Firefox vector http://eng.uber.com/prettyPhotoi/x,/x POC Google and IE...

Uber: Estimation of a Lower Bound on Number of Uber Drivers via Enumeration

@ddworken discovered a way to estimate a lower bound on the number of Uber drivers via an endpoint with low entropy. Thanks for the report @ddworken! Good summary from @Uber, just wanted to clarify that we are sticking to limited disclosure since this issue was only patched moving forward so not...

Uber Bug Bounty Rewards Loyalty, Promises Transparency

Uber’s bug bounty program emerged from private beta mode yesterday, which it used as a feedback forum for participants in order to develop the public program. “This was pretty unique in its approach,” said HackerOne CTO Alex Rice. Uber’s program is built on the HackerOne platform, and Uber...

Uber: Avoiding Surge Pricing

Please have a look at the video in this video link which shows the bug and helps you reproduce the same following the steps. As you can see, there is surge of 1.3x in that area. But with this bug, one can avoid the surge. To explain the video in brief First I selected Uber Go with the pickup...

Uber: Create account in uber without signup form

Issue : We can able to signup new users without filling the signup form /we can easily insert the same record with multiple email id and phone numbers Impact : Uber have many offers for new signed users,this can be used to spam/create as many users as they want ,uber doesnt validate the parameter...

Uber: Bypassing Uber Partner's 3 Cancel Limit

The Uber Partner app was supposed to log you out of the app if you cancel three requests in a row, temporarily denying the Partner the ability to go online. This report detailed the ability to bypass that limitation...

Uber: Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers

Invite codes are 5 alphanumeric lower case characters. This means there are 36 26 + 10 possible options for each space in the invite code. In total this means there are 36^5 or 60,466,176 possible invite codes. Through enumerating through all possible invite codes, one can find the total number o...

Uber: Full path disclosure on track.uber.com

The page at track.uber.com had verbose stack traces enabled, allowing an attacker to learn information about the libraries, technologies and system information used in Uber Rush. Thanks, @firs0v!...

Uber: XSS on love.uber.com

Hi, here is an XSS vector on love.uber.com https://love.uber.com/australia/?iclaction=reminderpopup&target=javascript%3aalert%28%2ftest%2f%29%3b%2f%2f Anatoly Ivanov...

Uber: Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites

Limited disclosure at @jutsuce's request...

Uber: XSS in getrush.uber.com

'' 'https://getrush.uber.com/business?utmcampaign=tttttt%27%3C/script%3E%3Cscript%3Ealert0%3C/script%3E&utmmedium=top&utmsource=website''' You need to escape the utmcampaign parameter before rendering it in the HTML. Thanks, David Dworken...

Uber: LIsting of http://archive.uber.com/pypi/simple/

Hope the below link is not for public Directory/File listing with all files Sample files http://archive.uber.com/pypi/simple/...

Uber: Self-XSS Vulnerability on Password Reset Form

Hello Security Team, I have found Third Security Vulnerability on your website :- https://partners.uber.com/ Vulnerability :-"XSS vulnerability on password reset time :" My Payload is this :- '" Following This Reproduce Steps : 1 send password reset link on your email id 2 open password reset lin...

Uber: Open Redirect in riders.uber.com

There was an open redirect on riders.uber.com which would have made it possible for an attacker to redirect a victim through to another arbitrary site without user interaction. Thanks, @bobrov!...

Uber: Open Redirect in m.uber.com

Reproduction Steps: https://m.uber.com//youtube.com/%2F.. HTTP Response: HTTP/1.1 303 See Other ... Location: //youtube.com/%2F../...

Uber: Active Email Hyperlink Sent on riders.uber.com

On riders.uber.com when the rider changes their information an email will be sent to their email informing them a change has been made on their rider account. The rider can change their first name to anything within 45 characters and once the change has been made they can add an email to their...

Uber: Reflected XSS on Uber.com careers

Location www.uber.com/careers/ Description: It is possible for an attacker to inject an arbitrary javascript into city GET parameter. This leads to phishing, defacing from URL, stealing credentials by using a fake login page and many other client side risks. POC: - Logon to...

Uber: Multiple Vulnerabilities (Including SQLi) in love.uber.com

Hi, I noticed you are using a critically vulnerable version of WMPL. By accessing http://love.uber.com/wp-content/plugins/sitepress-multilingual-cms/changelog.md, Attacker could find out http://love.uber.com/ is running WMPL version 3.1.8.4 Which is Vulnerable to, 1. SQL injection which gives ful...

Uber: XSS @ love.uber.com

Hello Team, I found a Cross-Site Scripting XSS in http://love.uber.com/ I'm not sure if it is eligible for bounty, as this domain is not listed under scope of the program. still as the issue is an XSS, i wanted to bring it to your attention. please mark this report as informative if you're not...