Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com Analysed #219205 Valid Authentication Critical 2017-07-13 – 183 password reset token leaking allowed for ATO of an Uber account Analysed #173551 Valid Authentication Critical 2017-05-17 $10,000 100 SAML Authentication Bypass on uchat.uberinternal.com Analysed #223014 Valid Authentication High 2017-09-05 $8,500 88 Authorization issue in Google G Suite allows DoS through HTTP redirect Analysed #191196 Valid Denial of Service High 2017-02-09 – 62 SQL injection in 3rd party software Anomali Analysed #206872 Valid SQL Injection High 2017-03-21 $2,500 61 phone number exposure for riders/drivers given email/uuid Analysed #225243 Valid Information Disclosure Medium 2017-06-02 – 36 pam-ussh may be tricked into using another logged in user's ssh-agent #204802 Valid Authentication Medium 2017-03-20 – 23 deleting payment profile during active trip puts account into arrears but active trip is temporarily “free” #216373 Valid Input Validation and Logic None 2017-06-28 – 20 Session not expired When logout [partners.uber.com] #231041 N/A No weakness recorded None 2017-05-26 – 12 It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without #298862 Informative Authentication Medium 2017-12-26 – 7 The Microsoft Store Uber App Does Not Implement Certificate Pinning #293358 Duplicate Cryptography Critical 2017-12-24 – 7 Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication #298990 Informative Authentication Medium 2017-12-26 – 6 ability to retrieve a user's phone-number/email for a given inviteCode #178503 Valid Information Disclosure – 2017-05-17 – 6 muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint #300102 Duplicate Cross-site Scripting Critical 2017-12-26 – 5 The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting #293359 Informative Authentication High 2017-12-24 – 5 udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint #300103 Duplicate Cross-site Scripting Critical 2017-12-26 – 3 lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint #300101 Duplicate Cross-site Scripting Critical 2017-12-26 – 3 SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint #300081 Duplicate Cross-site Scripting Critical 2017-12-26 – 3 SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint #300080 Duplicate Cross-site Scripting Critical 2017-12-26 – 3 SSL-protected Reflected XSS in m.uber.com #296701 Duplicate Cross-site Scripting Critical 2017-12-26 – 3 The Microsoft Store Uber App Does Not Implement Server-side Token Revocation #293363 Informative Authentication Medium 2017-12-24 – 3 Design Issue at riders.uber.com/profile #298888 Informative Input Validation and Logic None 2017-12-28 – 1