Uber · Report #193799
XSS in ubermovement.com via editable Google Sheets
Validstatus
mediumseverity
$2,000bounty
11upvotes
19 Dec 2018disclosed
Summary
A publicly-editable Google Sheet rendered on various ubermovement.com subdomains allowed anyone to inject HTML content into the page. It was possible for an attacker to inject malicious JavaScript code into the page by editing cells within the sheet, which would then be loaded by anyone who viewed the site.
Thanks @reptou!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.