Uber · Report #343120
Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF
Validstatus
mediumseverity
$500bounty
15upvotes
15 Mar 2021disclosed
Summary
A malicious website can cause visitors who are currently authenticated to https://uberps.com to take sensitive actions on https://uberps.com
A basic CSRF vuln on a old uber microsite.
Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.