HexBrain

Uber · Report #125059

Self-XSS Vulnerability on Password Reset Form

Duplicatestatus
5upvotes
13 Jun 2016disclosed

How it was found

Hello Security Team,

I have found Third Security Vulnerability on your website :- https://partners.uber.com/

Vulnerability :-"XSS vulnerability on password reset time :)"

My Payload is this :- >'>"><img src=x onmouseover =prompt(document.domain)>

Following This Reproduce Steps :)

  1. send password reset link on your email id
  2. open password reset link
  3. set as password this payload :- >'>"><img src=x onmouseover =prompt(document.domain)>
  4. Continue and click on show password XSS got triaged

Youtube Video Link :- https://youtu.be/UpUbq58LV9Y

I request to you sir if this is not valid then close as informative please sir, am just reported this issue because this XSS on password reset time please sir:)

If valid then I hope, you will FIX ASAP

Regards, Pratik Panchal

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original