[ad_1]
A vulnerability in Uber’s e-mail system permits nearly anybody to ship emails on behalf of Uber.
The researcher who found this flaw warns this vulnerability might be abused by menace actors to e-mail 57 million Uber customers and drivers whose data was leaked within the 2016 knowledge breach.
Uber appears to concentrate on the flaw however has not fastened it for now.
‘Your Uber is arriving now’
Safety researcher and bug bounty hunter Seif Elsallamy found a flaw in Uber’s methods that permits anybody to ship emails on behalf of Uber.
These emails, despatched from Uber’s servers, would seem official to an e-mail supplier (as a result of technically they’re) and make it previous any spam filters.
Think about getting a message from Uber stating, ‘Your Uber is arriving now,’ or ‘Your Thursday morning journey with Uber’—once you by no means made these journeys.
In an illustration, Elsallamy despatched me the next e-mail message that, indubitably, appeared to have come from Uber and landed proper in my inbox, not junk:
The e-mail type despatched to BleepingComputer by the researcher urges the Uber buyer to offer their bank card data.
On clicking ‘Affirm,’ the shape submits the textual content fields to a take a look at web site arrange by the researcher.
Observe, nonetheless, the message did have a transparent disclaimer in the direction of the underside stating, “this can be a safety vulnerability Proof of Idea,” and was despatched to BleepingComputer with prior permission.
On New 12 months’s Eve of 2021, the researcher responsibly reported the vulnerability to Uber through their HackerOne bug bounty program.
Nevertheless, his report was rejected for being “out-of-scope” on the inaccurate assumption that exploitation of the technical flaw itself required some type of social engineering:
It appears this is not the primary time that Uber has dismissed this explicit flaw both.
Bug bounty hunters Soufiane el Habti and Shiva Maharaj declare they’d beforehand reported the difficulty to Uber with out success [1, 2, 3].
57 million Uber prospects and drivers in danger
Opposite to what one could imagine, this is not a easy case of e-mail spoofing utilized by menace actors to craft phishing emails.
The truth is, the e-mail despatched by the researcher “from Uber” to BleepingComputer handed each DKIM and DMARC safety checks, in keeping with e-mail headers seen by us.
The researcher’s e-mail was despatched through SendGrid, an e-mail advertising and marketing and buyer communications platform utilized by main firms.
However, Elsallamy tells BleepingComputer that it’s an uncovered endpoint on Uber’s servers liable for the flaw and permits anybody to craft an e-mail on behalf of Uber.
The vulnerability is “an HTML injection in one among Uber’s e-mail endpoints,” says Elsallamy, drawing comparability to a comparable flaw found in 2019 on Meta’s (Fb’s) servers by pen-tester Youssef Sammouda.
In Meta’s case, the endpoint seemed an identical to:
https://authorized.tapprd.thefacebook.com/tapprd/Portal/ShowWorkFlow/AnonymousEmbed/XXXXXXXXXXXXX Understandably, for safety causes, the researcher didn’t disclose the weak Uber endpoint.
He questioned Uber, “Deliver your [calculator] and inform me what could be the consequence if this vulnerability has been used with the 57 million e-mail [addresses that leaked] from the final knowledge breach?”
“If the consequence then inform your workers within the bug bounty triage group.”
Elsallamy is referring to Uber’s 2016 knowledge breach that uncovered the private data of 57 million Uber prospects and drivers.
For this mishap, UK’s Info Commissioner’s Workplace (ICO) had fined Uber £385,000, together with the knowledge safety authority within the Netherlands (Autoriteit Persoonsgegevens) fining the corporate €600.000.
By exploiting this unpatched vulnerability, adversaries can doubtlessly ship focused phishing scams to thousands and thousands of Uber customers beforehand affected by the breach.
When requested what might Uber do to remediate the flaw, the researcher advises:
“They should sanitize the customers’ enter within the weak undisclosed type. For the reason that HTML is being rendered, they could use a safety encoding library to do HTML entity encoding so any HTML seems as textual content,” Elsallamy advised BleepingComputer.
BleepingComputer reached out to Uber nicely prematurely of publishing however has not heard again presently.
Uber customers, employees, drivers, and associates ought to be careful for any phishing emails despatched from Uber that look like official as exploitation of this flaw by menace actors stays a risk.
Replace 11:55 AM: Added reference to the similar flaw having been reported in 2015/16 and March 2021 however dismissed.
[ad_2]
