Uber · Report #163067
Stealing users password (Limited Scenario)
Summary
The Forgot Password page accepts a next_url URL parameter when it's loaded. Due to the fact that this is user-controllable and permits any url, it is possible for an attacker to perform a convincing phishing attack, designed to steal an Uber user's credentials, by getting a victim to reset their password via a custom Forgot Password link.
Hey all :)
here is blog for the same : http://www.geekboy.ninja/blog/uber-exploiting-stored-url-redirect-in-password-reset-token
How it was found
Hello Team,
Description :
This is report is about an interesting scenario where an user's password can be steal while password reset process due to wired user controlled redirection take place after password reset process.
By accepting the fact that URL redirect is not in scope for uber but this one is interesting on reset page that something need to look.
Step To Reproduce :
- Go Here
- Where
next_urlis user controlled on password reset pagehttps://login.uber.com/forgot-password?source=auth&next_url=user_controlled_url. - Request password reset token for your account !
- Get the reset link and change the password and will be redirected to supplied
next_urlurl. - Where an well crafted form will ask to confirm your password !
- And this is how someone can steal the password of someone !
Impact :
though impact is not very direct here , but still critical enough if any attacker succeeded to exploit this & that will allow him to access victim account , so this should be fixed !
Video POC (Tested in Mozilla) : https://dl.dropboxusercontent.com/u/62765113/ShareX/16/2016-08-24_19-18-20.mp4
Possible Fix :
next_urlshould not be reflect after password reset also should not be user controlled .
Please let me know if any more info needed !
Regards Geekboy !