{"id":123,"date":"2016-09-30T01:58:22","date_gmt":"2016-09-29T20:28:22","guid":{"rendered":"http:\/\/www.geekboy.ninja\/blog\/?p=123"},"modified":"2016-09-30T01:58:22","modified_gmt":"2016-09-29T20:28:22","slug":"uber-exploiting-stored-url-redirect-in-password-reset-token","status":"publish","type":"post","link":"http:\/\/www.geekboy.ninja\/blog\/uber-exploiting-stored-url-redirect-in-password-reset-token\/","title":{"rendered":"Uber | Exploiting Stored URL Redirect in Password Reset Token"},"content":{"rendered":"

Hello Friends !<\/span><\/p>\n

while trying my luck with Uber<\/strong>\u00a0i came a cross a wired behaviors in the\u00a0application which is not very common in today’s world.<\/span><\/p>\n

i was messing around with password reset token generation of Uber<\/strong>, while requesting for password reset link i appended some known get parameter with password reset request which i was noticed before while checking for URL redirect issues in\u00a0there oauth implementation.<\/span><\/p>\n

it was NEXT<\/strong>\u00a0parameter which is responsible\u00a0for next URL or page after successful login.<\/span><\/p>\n

so now come to password reset page, normally Uber<\/strong> password reset page URL\u00a0looks like :\u00a0https:\/\/login.uber.com\/forgot-password<\/strong> , where crafted URL<\/strong> looks like :\u00a0https:\/\/login.uber.com\/forgot-password?source=auth&next_url=evil.com<\/strong> .<\/span><\/p>\n

so once users will request password reset token via crafted link<\/strong> , user\u00a0will get password reset token and once user\u00a0set his new password, user\u00a0will redirected to evil.com<\/strong>.<\/span><\/p>\n

its a bug but as we know Uber don’t accept URL redirect<\/strong> issue until and\u00a0unless\u00a0there is something special, as URL redirect take place while password reset, i need to take advantage\u00a0of it.<\/span><\/p>\n

i made a form which looks like same as Uber<\/strong> form which ask for Confirm\u00a0Password<\/strong>\u00a0after user sets his New Password<\/strong> which looks like :<\/span><\/p>\n

\"pass\"<\/a><\/span><\/p>\n

i used data:<\/strong> scheme to make sure it looks more legit\u00a0instead of using any direct URL.<\/span><\/p>\n

so now the scenario\u00a0is :<\/span><\/p>\n