Uber · Report #162809
Changing paymentProfileUuid when booking a trip allows free rides
Validstatus
73upvotes
15 Sept 2016disclosed
Summary
Requests made to the /proxy-rt/riders/me/pickup endpoint on https://m.uber.com/ failed to properly validate payment profile UUIDs. If an invalid payment profile UUID was specified, the trip would not be properly charged and would be free. If another user's payment profile UUID was specified, that payment profile would be charged. Payment profile UUID's are random type 4 UUIDs. After an investigation, it does not appear this was exploited. The rider account would go into arrears.
==>Up
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.