Uber · Report #724522
Change the rating of any trip, therefore change the average driver rating
Validstatus
mediumseverity
$1,500bounty
43upvotes
6 Apr 2020disclosed
Summary
The endpoint used for rating the driver did not validate correctly if the trip corresponded to one made per user logged in, therefore knowing the tripUUID, driverUUID and userId made it possible to change the rating of any trip. Attack scenario: a bad driver with poor ratings and programming skills could change the ratings of their past trips to artificially inflate their rating.
Thanks again, @overjt!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.