Uber · Report #953649
Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser
Validstatus
criticalseverity
49upvotes
29 Mar 2021disclosed
Summary
The researcher has identified that the API endpoint can be leveraged to return a sensitivetoken that can be leveraged for access to rtapi endpoints. As example change x-uber-token value with the following found code:
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.