Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter.
Program: Uber
Bug Type: Information Disclosure
Bounty: Unspecified
Date: 2019-04-19
misconfiguration
information-disclosure
API-vulnerability
Summary
The researcher found out that it was possible to pass in another user's UUID to userUuid post parameter to https://bonjour.uber.com/marketplace/_rpc?rpc=getConsentScreenDetails
and retrieved data, which included mobile API token which could be potentially used to takeover the driver/rider account.