A vulnerability in Uber’s e mail system permits nearly anybody to ship emails on behalf of Uber.
The researcher who found this flaw warns this vulnerability will be abused by risk actors to e mail 57 million Uber customers and drivers whose data was leaked within the 2016 information breach.
Uber appears to pay attention to the flaw however has not mounted it for now.
‘Your Uber is arriving now’
Safety researcher and bug bounty hunter Seif Elsallamy found a flaw in Uber’s methods that permits anybody to ship emails on behalf of Uber.
These emails, despatched from Uber’s servers, would seem authentic to an e mail supplier (as a result of technically they’re) and make it previous any spam filters.
Think about getting a message from Uber stating, ‘Your Uber is arriving now,’ or ‘Your Thursday morning journey with Uber’—while you by no means made these journeys.
In an indication, Elsallamy despatched me the next e mail message that, indubitably, appeared to have come from Uber and landed proper in my inbox, not junk:
PoC e mail despatched to BleepingComputer from Uber’s servers
The e-mail kind despatched to BleepingComputer by the researcher urges the Uber buyer to supply their bank card data.
Be aware, nevertheless, the e-mail physique did have a transparent disclaimer in the direction of the underside stating, “it is a safety vulnerability Proof of Idea,” and was despatched to BleepingComputer with prior permission.
PoC disclaimer within the e mail despatched to BleepingComputer from Uber
On New 12 months’s Eve of 2021, the researcher responsibly reported the vulnerability to Uber through their HackerOne bug bounty program.
Nevertheless, his report was rejected for being “out-of-scope” on the faulty assumption that exploitation of the technical flaw itself required some type of social engineering:
Uber rejects researcher’s report concluding that it requires social engineering (Twitter)
57 million Uber prospects and drivers in danger
Opposite to what one could consider, this is not a easy case of e mail spoofing utilized by risk actors to craft phishing emails.
The truth is, the e-mail despatched by the researcher “from Uber” to BleepingComputer handed each DKIM and DMARC safety checks, in accordance with e mail headers seen by us.
E mail despatched “from Uber” passes DKIM and DMARC safety checks (BleepingComputer)
The researcher’s e mail was despatched through SendGrid, an e mail advertising and buyer communications platform utilized by main firms.
However, Elsallamy tells BleepingComputer that it’s an uncovered endpoint on Uber’s servers liable for the flaw and permits anybody to craft an e mail on behalf of Uber.
The vulnerability is “an HTML injection in one in every of Uber’s e mail endpoints,” says Elsallamy, drawing comparability to a related flaw found in 2019 on Meta’s (Fb’s) servers by pen-tester Youssef Sammouda.
In Meta’s case, the endpoint appeared an identical to:
https://authorized.tapprd.thefacebook.com/tapprd/Portal/ShowWorkFlow/AnonymousEmbed/XXXXXXXXXXXXX
Understandably, for safety causes, the researcher didn’t disclose the susceptible Uber endpoint.
He questioned Uber, “Carry your [calculator] and inform me what could be the end result if this vulnerability has been used with the 57 million e mail [addresses that leaked] from the final information breach?”
“If you understand the end result then inform your workers within the bug bounty triage staff.”
Elsallamy is referring to Uber’s 2016 information breach that uncovered the private data of 57 million Uber prospects and drivers.
For this mishap, UK’s Info Commissioner’s Workplace (ICO) had fined Uber £385,000, together with the information safety authority within the Netherlands (Autoriteit Persoonsgegevens) fining the corporate €600.000.
By exploiting this unpatched vulnerability, adversaries can probably ship focused phishing scams to thousands and thousands of Uber customers beforehand affected by the breach.
When requested what might Uber do to remediate the flaw, the researcher advises:
“They should sanitize the customers’ enter within the susceptible undisclosed kind. Because the HTML is being rendered, they may use a safety encoding library to do HTML entity encoding so any HTML seems as textual content,” Elsallamy informed BleepingComputer.
BleepingComputer reached out to Uber properly prematurely of publishing however has not heard again at the moment.
Uber customers, workers, drivers, and associates ought to be careful for any phishing emails despatched from Uber that look like authentic as exploitation of this flaw by risk actors stays a risk.