HexBrain

Uber · Report #724522

Change the rating of any trip, therefore change the average driver rating

Validstatus
mediumseverity
$1,500bounty
43upvotes
6 Apr 2020disclosed

Summary

The endpoint used for rating the driver did not validate correctly if the trip corresponded to one made per user logged in, therefore knowing the tripUUID, driverUUID and userId made it possible to change the rating of any trip. Attack scenario: a bad driver with poor ratings and programming skills could change the ratings of their past trips to artificially inflate their rating.

Thanks again, @overjt!

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original