Authorization issue in Google G Suite allows DoS through HTTP redirect

Summary

The combination of an authorization flaw in Google’s G Suite and a misconfiguration on Uber’s behalf, allowed @uranium238 to set up an HTTP redirect for the domain ubereats.com. For some UberEats customers, this resulted in not being able to use the service for a short period of time.

@uranium238 brought the vulnerability to our attention, was able to demonstrate the security impact, and worked with both Uber and Google to validate the fixes. We look forward to more reports from @uranium238 in the future.

Uber handled this report in a professional manner. Overall, I love reporting bugs to Uber. Thank you for everyone at Uber who worked on this and sorry for the trouble this bug caused for a while. https://medium.com/@rojanrijal/this-domain-is-my-domain-g-suite-a-record-vulnerability-b447a90a8de7 Cheers, @uranium238