Stored XSS on any page in most Uber domains

Summary

Due to two IDOR vulnerabilities in Tealium, it was possible to compromise an administrator’s account and inject arbitrary Javascript into https://tags.tiqcdn.com/utag/uber/*, which an attacker could leverage for a stored XSS attack on several Uber domains. Additionally, a Tealium user’s password and MFA were resettable by any user, allowing an attacker to take over the account and modify code on their behalf. Although Uber does not own Tealium, we pay our bounties based on impact. Since we had widely implemented this on many different uber.com domains, we awarded a bounty comparable to this bug’s impact. The bug was disclosed to the vendor by @mdv and patched for all Tealium users.