# Turning Self-XSS into Good XSS v2: Challenge Completed but Not Rewarded

Self-XSS on m.uber.com chained with CRLF cookie-injection on business.uber.com let an attacker set the oauth2 cookie scope and steal any logged-in user's session.

- Payout: $1,000
- Severity: high
- Program: Uber
- Credited: -
- Disclosed: 2016-08-29
- Write-up quality: 7/10
- Original: https://httpsonly.blogspot.com/2016/08/turning-self-xss-into-good-xss-v2.html
- Library page: https://bugbountylibrary.com/r/blog%3Ahttpsonly-blogspot-com-2016-08-turning-self-xss-into-good-xss-v2-html
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth technique:chained vuln:account-takeover vuln:crlf-injection vuln:xss

**Target:** business.uber.com confirm endpoint and m.uber.com profile
**Root cause:** User input in the /new/confirm/ path is reflected unsanitized into the Set-Cookie header, allowing arbitrary cookie injection for *.uber.com; m.uber.com renders profile name as stored XSS.
**Steps:**
1. Inject XSS payload into business profile name via mobile app so it renders on m.uber.com index after login.
2. Request `https://business.uber.com/new/confirm/test;,token=ATTACKER_TOKEN;domain=.uber.com` to set attacker's token cookie scoped to *.uber.com.
3. Victim loads attacker page; JS issues the cookie-injection request, then redirects to `https://m.uber.com/`.
4. Victim is now logged into attacker's account and the Self-XSS fires, executing attacker JS in m.uber.com origin.
5. Payload reads the victim's oauth2 cookie (scoped to *.uber.com) and exfiltrates it.
**How found:** Inspired by Jack's Self-XSS post, spent two months hunting for a way to force a victim into the attacker's account; discovered m.uber.com authenticates on the token cookie alone while other subdomains need oauth2, then found the confirm endpoint reflects input into the Cookie header.
**Exploitation:** Attacker hosts a page that first sets the token cookie via the CRLF injection on business.uber.com, then redirects the victim to m.uber.com where the stored XSS executes and steals the oauth2 cookie, enabling full account takeover.
**Escalation:** Chained a low-impact Self-XSS with a cookie-injection bug to convert it into a session-stealing Good XSS affecting any logged-in Uber user.
**Insight:** When a subdomain authenticates on a weaker cookie than siblings, look for any header-injection or cookie-setting primitive on a sibling subdomain to plant that weaker cookie and pivot the XSS into stealing the stronger scoped cookie.