Uber · Report #231041
Session not expired When logout [partners.uber.com]
Summary
This report attempts to demonstrate that sessions are not invalidated on logout for partners.uber.com. The behavior could not be reproduced and researcher became hostile, claiming we were misleading them. No action was taken on behalf of this report.
We pride ourselves in honest, open and respectful interactions with researchers -- this report is the exact opposite of that.
It's funny, when i can reproduce it 4 days ago and make some video, the team said we’re unable to reproduce this issue following the steps you provided.
the team it's fixed this issue, and say this is was unvalidated issue, someone please talk with them to close them program on hackerone, that's make hackerone name it's not good anymore :)
~dont forget to make some video guys :) because fake bug bounty is real :)
Relating Issue another researcher : https://httpsonly.blogspot.com/2016/08/turning-self-xss-into-good-xss-v2.html
How it was found
Hi,
Summary
partners.uber.com website is not expiring the user's session immediately after logout.
when user logout, the session not expired, and still can send request and the server respond response with OKAY
Steps to Reproduce:
- Log into the website - partners.uber.com
- Capture any request. For ex, profile edit page using burp proxy.
- Logout from the website.
- Replay the request captured in step 2 and notice it displays the proper response.
Thanks, tell me if you need video, i will create one !