Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains

Summary

When creating new tags on Tealium, the application did not check that the user creating the tag had authorized as the same account they were creating a tag for. It was possible for an attacker to inject arbitrary content into a web page using the utag.js tag. Depending on how the victim implemented these tags, this could potentially allow for text injection, content injection, and HTML injection into the DOM, and even cross-site scripting vulnerabilities. Although Uber does not own Tealium, we pay our bounties based on impact. Since we had widely implemented this on many different uber.com domains, we awarded a bounty in line with this bug’s impact. We also communicated with the Tealium team to patch this vulnerability for all other Tealium users.