Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII

Summary

The hacker identified a registration page on a website ran by a 3rd party for Uber for managing Uber Eats devices, for example devices' returns when they stop working. Due to the authentication not being integrated with Uber's central authentication, the website was interesting. Although the registration page only allowed emails under uber.com to register it was possible to register a similar domain name that satisfied the backend checks (likely a loose regular expression check) to create an account. It was then possible to access site content, as well as gain control of the whole platform due to flat access control.

The hacker identified a registration page on a website ran by a 3rd party for Uber for managing Uber Eats devices, for example devices' returns when they stop working. Due to the authentication not being integrated with Uber's central authentication, the website was interesting. Although the registration page only allowed emails under uber.com to register it was possible to register a similar domain name that satisfied the backend checks (likely a loose regular expression check) to create an account. It was then possible to access Uber staff and customers information, as well as gain control of the whole platform due to flat access control.