HexBrain
Open on HackerOneSign in

Uber · Report #125112

XSS in getrush.uber.com

Validstatus
$3,000bounty
6upvotes
6 Apr 2016disclosed

Summary

Reflected XSS in getrush.uber.com due to not escaping certain tracking parameters.

How it was found

'' 'https://getrush.uber.com/business?utm_campaign=tttttt%27%3C/script%3E%3Cscript%3Ealert(0)%3C/script%3E&utm_medium=top&utm_source=website'''

You need to escape the utm_campaign parameter before rendering it in the HTML.

Thanks, David Dworken

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original