Uber · Report #117190

Reflected XSS on Uber.com careers

Validstatus

8upvotes

6 Apr 2016disclosed

Summary

This issue was originally reported via email: [email protected] Matthew invited to this private program and asked to submit here. Thank you team!

How it was found

Location

www.uber.com/careers/

Description:

It is possible for an attacker to inject an arbitrary javascript into city GET parameter. This leads to phishing, defacing from URL, stealing credentials by using a fake login page and many other client side risks.

POC:

Logon to [uber.com/careers/list/?city=...](https://www.uber.com/careers/list/?city=allicg<%2fscript><script>alert('xss by pavanw3b')<%2fscript>fupaiiz&country=all&keywords=&subteam=all&team=all) on firefox.
Note the alert xss by pavanw3b as the screenshot attached.

Tested on latest firefox: 4.0.2

Please let me know if you need further explanation or details.

Cheers, Pavan www.pavanw3b.com | fb/pavanw3b | @pavanw3b

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original