Uber · Report #122791
Active Email Hyperlink Sent on riders.uber.com
Summary
Blog post: http://www.rohk.xyz/hackers-and-companies-responses/
The type of responses companies give to researchers is crucial to developing relationships. Check out the blog post I wrote which talks about the importance of proper responses.
How it was found
On riders.uber.com when the rider changes their information an email will be sent to their email informing them a change has been made on their rider account.
The rider can change their first name to anything within 45 characters and once the change has been made they can add an email to their account. But once they add the email, a confirmation email will be sent but will contain the riders first name. If the rider changed their first name to Rider. Visit www.yahoo.com for more info. the URL posted will have an active hyperlink.
`Hi Rider. Visit www.yahoo.com for more info.,
Please visit this link to confirm your email address:
https://riders.uber.com/confirm-email?email_token=
Love, Team Uber`
PoC:
This issue does reply on some type of social engineering
The attacker can purchase a short domain and put a message within 45 characters as their first name.
Once they have done that they can start adding and/or replacing emails a bunch of times to send mass emails and these emails will be coming from [email protected]
Once the person receiving the emails clicks on the link, they will be redirected to some malicious website.
Video: https://www.dropbox.com/s/84e7oftmcdmb4sw/emailhyperlink.mov?dl=0
Possible Fix: Do not allow links to be set as the riders names. Do not allow special characters (. , / \ etc.)