Uber · Report #361438
Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files
Validstatus
lowseverity
$500bounty
70upvotes
12 Mar 2021disclosed
Summary
The Uber Greece AWS S3 bucket was open, allowing any remote user to view and download the files. Some of these files included confidential internal documents which could negatively impact Uber's brand.
I found a uber microsite that had a link to this AWS bucket being used by Uber greece. Had some internal files and it was fixed quickly.
Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.