# Gaining access to Uber's user data through AMPScript evaluation

Uber's exacttarget-web-hook preview endpoint evaluated user-supplied AMPScript, letting an attacker query Salesforce data extensions and dump driver emails and UUIDs.

- Payout: $23,000
- Severity: critical
- Program: Uber
- Credited: Shubham Shah
- Disclosed: 2019-01-14
- Write-up quality: 8/10
- Original: https://blog.assetnote.io/bug-bounty/2019/01/14/gaining-access-to-ubers-user-data-through-ampscript-evaluation/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-assetnote-io-bug-bounty-2019-01-14-gaining-access-to-ubers-user-data-through-ampscript-evaluation
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:critical tech:nodejs technique:recon technique:source-review vuln:info-disclosure vuln:ssrf vuln:ssti

**Target:** Express.js webhook/preview endpoint backed by Salesforce Marketing Cloud AMPScript
**Root cause:** The /preview endpoint passed the user-controlled message parameter directly into an AMPScript evaluator, allowing arbitrary AMPScript functions like HTTPGet and LookupRows to execute against Salesforce data extensions.
**Steps:**
1. Recon subdomain exacttarget-web-hook.uber.com; it began returning an internal API console for message personalization
2. Extract own account UUID from HTML source of https://riders.uber.com/profile
3. Send `GET /preview?contactKey=<own-uuid>&dataExtension=driver_partners&create_new=true&message=&business_unit=` to get a working baseline
4. Confirm code execution with `message=%%=HTTPGet('https://ipinfo.io')=%%`; response originates from AS22606 ExactTarget
5. Craft AMPScript using `LookupRows('driver_partners','firstname','Shubs')`, `RowCount`, `Row`, `Field` to iterate rows and print UUID, joinDate, email, firstName
6. URL-encode the AMPScript into the `message` parameter and send to /preview to dump matching user records
**How found:** Continuous asset monitoring flagged the previously-404 subdomain suddenly returning an internal test console; reading the example message revealed AMPScript syntax, and the subdomain name exacttarget-web-hook linked it to Salesforce/ExactTarget, prompting tests of AMPScript functions like HTTPGet and LookupRows.
**Exploitation:** Attacker with any authenticated Uber account UUID could hit the public preview endpoint with arbitrary AMPScript in the message parameter, using LookupRows/Field to read arbitrary rows from Salesforce data extensions (e.g. driver_partners) and HTTPGet for SSRF, exfiltrating PII such as emails and UUIDs en masse or by targeted first-name lookup.
**Escalation:** Mass extraction possible by iterating over data extension rows or querying by common first names to enumerate the entire driver_partners table.
**Insight:** When a subdomain name references a third-party marketing/email vendor (exacttarget, sendgrid, mailchimp), test whether templating/personalization fields are evaluated as that vendor's scripting language (AMPScript, Handlebars, Liquid) — vendor DSLs often expose HTTP and database-lookup primitives that turn a preview endpoint into SSRF and data exfiltration.