5 ms·

Only the XSS one was a real vulnerability, they should have paid $500 at least for that though.

reificator 9y ago
Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.
- GregoryVPerry 9y ago
  Yeah that's a big one, and an issue with the core of their entire authentication workflow that they cannot fix without invalidating tens of millions of apps or forcing everyone to upgrade. Whenever you sign off of their mobile app there is no communication with the network, they are just erasing the token on the client side.
  - sushid 9y ago
    Not the parent commenter and I get what you mean, but if they state that it's a duplicate issue (and assuming on good faith that it is), doesn't it make sense that they don't pay you out for that? I'm 100% on your side regarding the XSS issue but you can't expect them to have a list of security vulnerabilities that they've already discovered at your disposal.
    - chris_wot 9y ago
      Yeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented. Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!
  - deleted 9y ago
    [deleted]
- user5994461 9y ago
  I recall that either OAuth or SAML doesn't have capabilities for logout.
  - mdaniel 9y ago
    I believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAuth and JWT via token revocation on the server-side SAML has an actual logout endpoint
fredericoqq 9y ago
I don't understand why he didn't make an alert(document.domain), the universal "this is legit" bat signal. Instead, creating some weird form phishing demo? I think there is more to this story, it sounds like this wasn't a "Cross Site Scripting", but "Content Injection" or "Content Spoofing", a far less serious bug. You're gonna hate me, but I would award $0 for Content Injection, it's just not a big deal ¯\_(ツ)_/¯
- GregoryVPerry 9y ago
  Initially JavaScript was being escaped with their WAF. The second POC demonstrated the ability to evade both their WAF and XSS_Auditor. Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host. That's pretty much the whole story.
  - fredericoqq 9y ago
    Could you make an alert(1) or not? If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?
    - netsec_burn 9y ago
      Now I'm starting to wonder the same thing, *.cloudfront.net is not Uber.
IncRnd 9y ago
> Only the XSS one was a real vulnerability, they should have paid $500 at least for that though. That's false. Non-expired authentication tokens is a serious issue.

Client side logout with seemingly no token expiration is a very serious vulnerability, especially for something like Uber where payments are involved.

GregoryVPerry 9y ago
Yeah that's a big one, and an issue with the core of their entire authentication workflow that they cannot fix without invalidating tens of millions of apps or forcing everyone to upgrade. Whenever you sign off of their mobile app there is no communication with the network, they are just erasing the token on the client side.
- sushid 9y ago
  Not the parent commenter and I get what you mean, but if they state that it's a duplicate issue (and assuming on good faith that it is), doesn't it make sense that they don't pay you out for that? I'm 100% on your side regarding the XSS issue but you can't expect them to have a list of security vulnerabilities that they've already discovered at your disposal.
  - chris_wot 9y ago
    Yeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented. Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!
- deleted 9y ago
  [deleted]
user5994461 9y ago
I recall that either OAuth or SAML doesn't have capabilities for logout.
- mdaniel 9y ago
  I believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAuth and JWT via token revocation on the server-side SAML has an actual logout endpoint

fredericoqq 9y ago

I don't understand why he didn't make an alert(document.domain), the universal "this is legit" bat signal. Instead, creating some weird form phishing demo? I think there is more to this story, it sounds like this wasn't a "Cross Site Scripting", but "Content Injection" or "Content Spoofing", a far less serious bug. You're gonna hate me, but I would award $0 for Content Injection, it's just not a big deal ¯\_(ツ)_/¯

GregoryVPerry 9y ago
Initially JavaScript was being escaped with their WAF. The second POC demonstrated the ability to evade both their WAF and XSS_Auditor. Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host. That's pretty much the whole story.
- fredericoqq 9y ago
  Could you make an alert(1) or not? If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?
  - netsec_burn 9y ago
    Now I'm starting to wonder the same thing, *.cloudfront.net is not Uber.

IncRnd 9y ago

> Only the XSS one was a real vulnerability, they should have paid $500 at least for that though. That's false. Non-expired authentication tokens is a serious issue.