Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Summary

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo.

Thanks, @r0t!

Uber has a feature in the iOS app to apply a promotion code right after we register an account.

Since there was no protection against brute force attacks, we were able to enumerate promotion codes, like in report #125505.

This is a similar bug but leaks more information than #125505:

• Promo code value
• Country
• Inviter’s name
• Inviter’s picture