(This project is deprecated and not maintained.)
We are interested in any vulnerability that could negatively affect the security of our users.
- Cross-site Scripting (XSS)
- Cross-site Request Forgery
- Server-Side Request Forgery (SSRF)
- SQL Injection
- Server-side Remote Code Execution (RCE)
- XML External Entity Attacks (XXE)
- Access Control Issues (Insecure Direct Object Reference issues, etc)
- Exposed Administrative Panels that don't require login credentials
- Directory Traversal Issues
- Local File Disclosure (LFD)
- api.uber.com
- bonjour.uber.com
- business.uber.com
- cn-cfe1.uber.com
- cn-dc1.uber.com
- cn-dc2.uber.com
- cn-dc3.uber.com
- cn-dca1.uber.com
- cn-geo1.uber.com
- cn-pek1.uber.com
- cn-pr.uber.com
- cn-sjc1.uber.com
- cn-slow1.uber.com
- cn-slow2.uber.com
- cn-slow3.uber.com
- cn-spdy.uber.com
- cn-tt1.uber.com
- cn.uber.com
- cn1.uber.com
- cnfrontend-dca1.uber.com
- cnfrontend-sjc1.uber.com
- cnfrontend.uber.com
- csp.uber.com
- developer.uber.com
- dial.uber.com
- eats.uber.com
- get.uber.com
- getrush.uber.com
- help.uber.com
- login.uber.com
- lert.uber.com
- m.uber.com
- partners.uber.com
- petition.uber.org
- riders.uber.com
- rush.uber.com
- sftp.uber.com
- sms.uber.com
- track.uber.com
- trip.uber.com
- ubereats.com
- ubermovement.com
- *.uberinternal.com
- vault.uber.com
- www.uber.com
- Android/iPhone Partner App
- Android/iPhone Rider App
- Android/iPhone Eats App
- Open redirects. 99% of open redirects have low security impact. For the rare cases where the impact is higher, e.g., stealing oauth tokens, we do still want to hear about them.
- Publicly accessible login panels - These generally have low security impact and are in software that Uber runs but doesn’t control.
- Reports that state that software is out of date/vulnerable without a proof of concept.
- Host header issues without an accompanying proof-of-concept demonstrating vulnerability.
- XSS issues that affect only outdated browsers.
- Stack traces that disclose information.
- CSV injection. Please see this article.
- Submissions on the S3 bucket
uber, We do not own this bucket!. - Best practices concerns.
- Highly speculative reports about theoretical damage. Be concrete.
- Self-XSS that can not be used to exploit other users (this includes having a user paste JavaScript into the browser console).
- Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue.
- Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated.
- Denial of Service Attacks.
- Reflected File Download (RFD).
window.opener-related issues.- Physical or social engineering attempts (this includes phishing attacks against Uber employees).
- Content injection issues.
- Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)
- Missing autocomplete attributes.
- Missing cookie flags on non-security-sensitive cookies.
- Issues that require physical access to a victim’s computer.
- Missing security headers that do not present an immediate security vulnerability.
- Fraud issues (please see the below section elaborating on this).
- SSL/TLS scan reports (this means output from sites such as SSL Labs).
- Banner grabbing issues (figuring out what web server we use, etc.).
- Open ports without an accompanying proof-of-concept demonstrating vulnerability.
- Recently disclosed 0day vulnerabilities. We need time to patch our systems just like everyone else - please give us two weeks before reporting these types of issues.
- Entering the Uber offices, throwing crisps everywhere, unleashing a bunch of hungry racoons, and hijacking an abandoned terminal on an unlocked workstation while staff are distracted.
- uber.onelogin.com
- OneLogin runs their own bug bounty program and any vulnerabilities for OneLogin should be reported to them.
- *.dev.uber.com
- *.dev.uberinternal.com
- brand.uberinternal.com
- *.et.uber.com - The underlying software here is exacttarget which Uber does not have control over.
- uber-finder.com - this is not software owned by Uber Engineering.
Our rewards are impact-based. This means, for example, that we will issue a relatively high reward for a vulnerability that has the potential to leak sensitive user data, but that we will issue little to no reward for a vulnerability that allows an attacker to deface a microsite. When we have our reward meetings, we always ask one question: If a malicious attacker abuses this, how bad off are we? We assume the worst and pay out the bug accordingly.
If we receive several reports for the same issue, we offer the bounty to the earliest report for which we had enough actionable information to identify the issue. We don't want to encourage people spamming us with vague issues in an attempt to be first.
If a single fix fixes multiple vulnerabilities, we treat this as a single vulnerability. For example, if you find 3 vulnerabilities in a WordPress plugin we use, and our fix is to remove the plugin, this will receive a single bounty, determined, as always, by impact.
The payout ranges on this page are guidelines to express roughly how we think about the severity of classes of issues. They are not exact rules. There can be attributes of bugs that make them more or less severe, which will affect the payout. For example, if a vulnerability affects only a small population of users, it will likely receive a lower reward than a similar vulnerability that affects a larger population of users. To date, we have most commonly rewarded on the top end of our published payout ranges.
At the end of the day, all reward amounts are at our discretion, but we aim to be fair. Some researchers won't agree with some of our decisions, but we're paying out to the best of our ethical ability and trust that the majority of researchers will consider their rewards fair and in many cases generous. We will adapt as the program continues.
- Microsites with little to no user data
- Issues requiring user-interaction
- Outdated wordpress instances
- Most brute forcing issues
N.B: the amounts listed here are the maximum we can pay for these categories of issues. This is meant as rough guidance on how we think about rewarding issues, ultimately we will reward largely based on the impact of the issue but at our discretion.
-
Critical issues ($10,000) - Remote code execution on a production server. Exposure of information that identifies individuals (social security numbers, credit card numbers, bank account numbers, driver license images) Full account takeover of rider/partner account without interaction. Payment or partner invoice information exposure at scale. Potential access to source code. XSS in Toolshed (our internal account management system), or server-side request forgery (SSRF). Vulnerabilities leading to the compromise of an employee account (with a way to bypass two-factor).
-
Significant Issues ($5,000) - Stored Cross-site Scripting which can cause significant brand damage (e.g. in a homepage), missing authorization checks leading to the exposure of email addresses, date of birth, names, phone numbers, etc.
-
Medium Issues ($3,000) - Reflected Cross-site Scripting (XSS), most Cross-site Request Forgery (CSRF) issues, access control issues which do not exposed PII but affect other accounts, some account validation bypasses (being able to change driver picture, etc). Any vulnerability which allows the bulk lookup of user UUIDs (e.g. turn an auto-incrementing ID into a UUID, turn an email into a UUID).
-
Fraud Issues - Send these to
ext-uber-fraud@uber.com. We currently do not reward for fraud issues.
We need detailed written steps to reproduce. We do not accept reports that include only a video.
You can view the changes to this policy over time at hackerone.com/uber/policy_versions.
If you’d like to report an issue related to fraud, please contact ext-uber-fraud@uber.com. These type of issues are important but we unfortunately cannot reward issues if this type at this time. Specifically promo code fraud and give-get fraud is abuse of our promotional offers and referral codes in order to get free rides from Uber are a common submission. We do not consider these in scope for our bug bounty program at this time unless they show an explicit technical vulnerability in our software. Lack of verification for things such as phone numbers, credit cards, etc are all fraud related issues and are not in scope for this bug bounty program.
- https://fin1te.net/articles/uber-turning-self-xss-into-good-xss/
- http://blog.portswigger.net/2016/04/adapting-angularjs-payloads-to-exploit.html
- http://blog.orange.tw/2016/04/bug-bounty-uber-ubercom-remote-code_7.html
- https://labs.integrity.pt/articles/uber-hacking-how-we-found-out-who-you-are-where-you-are-and-where-you-went/
Yes, but we ask that you wait until the issue is both fixed and paid out before you publish the blog post. We also prefer that you request disclosure through HackerOne so that readers of your blog post can get the full background on the issue.
Chaining of bugs is not frowned upon in any way, we love to see clever exploit chains! However, if you have managed to compromise an Uber-owned server we do not allow for escalations such as port scanning internal networks, privilege escalation attempts, attempting to pivot to other systems, etc. If you get access to an Uber server please report it us and we will reward you with an appropriate bounty taking into full consideration the severity of what could be done. Chaining a CSRF vulnerability with a self XSS? Nice! Using AWS access key to dump user info? Not cool.
As of this time we do not have a good system for creating test accounts for our bug bounty submitters. Please create an account as you would normally and perform testing with that account or accounts. Whenever possible only test against yourself, never other users. If there is ever a situation where you cannot test a bug while adhering to this please let us know and we will help figure out an appropriate solution.
We reward for issues which allow you to enumerate bulk user UUID's via a phone number or email address. For example, if there's an endpoint that allows you to submit an email and the response contains that user's UUID - this is a vulnerability we would reward for. To verify this you should compare the UUID you're seeing with your own email. To get your personal account UUID visit help.uber.com after authenticating and copy and paste the following JavaScript in your browser's developer console:
alert(JSON.parse($("#web-support-data-script").text).user.uuid);(We reward for this bug because we want to make it harder to perform bulk insecure direct object reference attacks against our users).
A vehicle UUID uniquely identifies a vehicle within our systems. Any instance where you could collect a lot of vehicle uuids is probably interesting to us, depending on the circumstances. To get a list of your vehicle UUIDs, navigate to https://partners.uber.com/vehicles/ and paste the following into your browser’s development console:
vuids = document.querySelectorAll( "#vehicle-uuid" );for( var i = 0;i<vuids.length;i++){console.log( vuids[i].value )};Found a particularly interesting or clever bug in an Uber service? We’re more than happy to publicly disclose your bug once it has been remediated by our developers. Please note that in certain situations we may request more time to investigate an issue internally to ensure that it is properly fixed across all Uber services. Public disclosure before Uber has had time to remediate an issue is grounds for immediate forfeiture of any reward as well as possible removal from the bug bounty program.
An Uber microsite is a website which is not explicitly listed in the scope above but is made by an Uber employee and owned by Uber. The most common examples of microsites include Uber city sites, blogs, and partner incentive sites.
Microsites are an important part of how Uber reaches people in diverse local markets all around the world. Since they have smaller audiences, shouldn't contain much or any user data and aren’t part of the our core services, the impact of issues on these sites is significantly less severe. Since we are primary interested in vulnerabilities which could lead to the exfiltration of customer information, vulnerabilities in microsite services will not be rewarded for except in extraordinary circumstances. Generally there are better areas to spend your time than microsites.
Your participation in the Bug Bounty Program is voluntary and subject to the Bug Bounty Program Terms.