Uber · Report #787240
Thumbor misconfiguration at blogapi.uber.com can lead to DoS
Validstatus
mediumseverity
$500bounty
6upvotes
25 Feb 2021disclosed
Summary
The subdomain blogapi.uber.com is internally downloading images from external sources and resizing it to arbitrary values, then sending a response to the user.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.