Uber · Report #390181
Reflected XSS on Partners Subdomain
Validstatus
highseverity
$2,000bounty
31upvotes
16 Sept 2018disclosed
Summary
There was a reflected cross site scripting vulnerability at https://partners.uber.com/. By providing a specifically crafted value, it was possible for an attacker to inject malicious content into the partners.uber.com site, which would then be executed when the site is loaded.
We enjoyed working with @mefkan on this issue and look forward to their next submission to our program.
I will publish my blog in a few days :) Check out my twitter ! https://twitter.com/mefkansec
And here it is...
https://medium.com/@efkan162/how-i-xssed-uber-and-bypassed-csp-9ae52404f4c5
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.