Hack The World 2017 Top 2 Bonus #300779 Valid No weakness recorded – 2018-11-13 $5,000 61 Authorization issue in Google G Suite allows DoS through HTTP redirect Analysed #191196 Valid Denial of Service High 2017-02-09 – 62 xss in https://www.uber.com Analysed #145278 Valid Cross-site Scripting – 2016-07-25 – 64 Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII Analysed #1148697 Valid Insecure Direct Object Reference High 2022-04-07 – 64 Lack of payment type validation in dial.uber.com allows for free rides Analysed #162199 Valid Input Validation and Logic High 2018-11-20 – 68 Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront Analysed #175070 Valid Access Control – 2016-12-12 – 69 Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files Analysed #361438 Valid Information Disclosure Low 2021-03-12 $500 70 Changing paymentProfileUuid when booking a trip allows free rides Analysed #162809 Valid Cross-Site Request Forgery – 2016-09-15 – 73 Subdomain takeover at signup.uber.com Analysed #197489 Valid Access Control High 2019-01-25 – 79 Pre-auth Remote Code Execution on multiple Uber SSL VPN servers Analysed #540242 Valid Command and Code Injection Critical 2021-02-24 $2,000 80 Possibility to get private email using UUID Analysed #127158 Valid Information Disclosure – 2016-06-15 – 82 Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balance Analysed #574638 Valid Input Validation and Logic Medium 2019-07-18 – 82 OneLogin authentication bypass on WordPress sites via XMLRPC Analysed #138869 Valid Command and Code Injection – 2016-07-15 $7,000 83 SAML Authentication Bypass on uchat.uberinternal.com Analysed #223014 Valid Authentication High 2017-09-05 $8,500 88 [CRITICAL] -- Complete Account Takeover #136885 Valid Authentication – 2016-08-15 $8,000 89 Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server Analysed #1883806 Valid Misconfiguration and Insecure Design Medium 2023-08-23 – 90 private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events Analysed #174404 Valid Information Disclosure Medium 2021-05-14 – 91 SQL Injection on sctrack.email.uber.com.cn Analysed #150156 Valid SQL Injection – 2016-07-25 $4,000 93 password reset token leaking allowed for ATO of an Uber account Analysed #173551 Valid Authentication Critical 2017-05-17 $10,000 100 Stored XSS on any page in most Uber domains Analysed #217739 Valid Cross-site Scripting High 2018-11-20 $6,000 107 ubernycmarketplace.com is vulnerable to the Heartbleed Bug Analysed #304190 Valid Information Disclosure Low 2020-04-23 $1,500 112 IDOR leads to See analytics of Loyalty Program in any restaurant. Analysed #1137819 Valid Insecure Direct Object Reference Medium 2021-05-28 – 112 Reflected XSS on https://www.uber.com Analysed #390386 Valid No weakness recorded High 2021-03-15 – 114 IDOR leads to leak analytics of any restaurant Analysed #1116387 Valid Insecure Direct Object Reference Medium 2021-04-29 – 123 Client secret, server tokens for developer applications returned by internal API Analysed #419655 Valid Information Disclosure – 2019-02-08 – 125 [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameter Analysed #392106 Valid Cross-site Scripting High 2021-02-25 $3,000 131 uber.com may RCE by Flask Jinja2 Template Injection Analysed #125980 Valid Command and Code Injection – 2016-04-06 $10,000 137 Reading Emails in Uber Subdomains Analysed #156536 Valid Authentication – 2016-09-14 – 141 Open Redirect on central.uber.com allows for account takeover Analysed #206591 Valid Authentication High 2019-01-25 – 144 Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com Analysed #219205 Valid Authentication Critical 2017-07-13 – 183 Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system. Analysed #530441 Valid Access Control Low 2021-03-06 $4,500 210 Stored XSS in developer.uber.com Analysed #131450 Valid Cross-site Scripting – 2016-06-27 $7,500 223 XSS At "pages.et.uber.com" #156098 N/A Cross-site Scripting – 2016-08-19 – 267 Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) Analysed #143717 Valid Authentication – 2016-07-14 – 312 RCE via npm misconfig -- installing internal libraries from the public registry Analysed #1007014 Valid Command and Code Injection Critical 2021-02-24 $9,000 325 Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg Analysed #340431 Valid Cryptography High 2020-04-30 $4,000 376 Chained Bugs to Leak Victim's Uber's FB Oauth Token Analysed #202781 Valid Authentication High 2019-01-25 – 427 [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo Analysed #591813 Valid Information Disclosure Critical 2021-02-25 $40,000 458 Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter Analysed #542340 Valid Information Disclosure High 2019-09-09 – 643