Uber · Report #197489
Subdomain takeover at signup.uber.com
Validstatus
highseverity
79upvotes
25 Jan 2019disclosed
Summary
The domain signup.uber.com was pointing to an unclaimed Netlify domain, allowing an attacker to take over the subdomain. We remediated this issue by deleting the CNAME record from our DNS.
Thanks, @ak1t4!
Another great TKO - thanks UBER!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.