Unrestricted File Upload Results in Cross-Site Scripting Attacks

Summary

It was found that an attacker can upload any type of file including HTML files when adding a menu during the onboarding process after signing up at https://www.ubereats.com/restaurant/en-CA/signup.

The hacker identified a file upload endpoint used by restaurants applying for Uber Eats which was unrestricted, in the sense that HTML or SVG files could be uploaded. Due to the fact that the contents of the files uploaded were being displayed in-browser (Content-Disposition: inline) this led to stored cross-site scripting.