Uber · Report #1540906
Full read SSRF in flyte-poc-us-east4.uberinternal.com
Validstatus
mediumseverity
$2,000bounty
30upvotes
26 May 2022disclosed
Summary
Uber summary TBD.
@shubs and I discovered an instance of Flyte Console on uberinternal.com. After auditing the open source code, we noticed an unauthenticated route for a “CORS proxy”. This was a classic server-side request forgery issue, allowing us to pass an arbitrary request to be performed by the server and read the response. This also allowed reflected cross-site scripting as we could proxy arbitrary HTML documents through it.
We reported this to both Uber and Flyte, where it was assigned CVE-2022-24856 and quickly resolved.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.