Uber · Report #540242

Pre-auth Remote Code Execution on multiple Uber SSL VPN servers

Validstatus

criticalseverity

$2,000bounty

80upvotes

24 Feb 2021disclosed

Summary

format string vulnerability on /sslmgr with no authentication required

Details:

http://blog.orange.tw/2019/07/attacking-ssl-vpn-part-1-preauth-rce-on-palo-alto.html

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original