# Uber Bug Bounty: Gaining Access To An Internal Chat System

Unsigned SAML assertion accepted by uchat.uberinternal.com SSO endpoint, letting an outsider log in as an Uber employee and read internal chat.

- Payout: $8,500
- Severity: critical
- Program: Uber
- Credited: Michael Reizelman
- Disclosed: 2017-10-13
- Write-up quality: 6/10
- Original: https://mishresec.wordpress.com/2017/10/13/uber-bug-bounty-gaining-access-to-an-internal-chat-system/
- Library page: https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-uber-bug-bounty-gaining-access-to-an-internal-chat-system
- Tags: domain:web impact:ato impact:internal-access kind:bounty platform:blog sev:critical tech:saml tech:sso technique:recon technique:source-review vuln:auth-bypass

**Target:** SAML SSO login endpoint (/login/sso/saml) on internal chat system
**Root cause:** The SAML service provider (php-saml) did not validate the assertion signature, trusting any well-formed assertion posted to the ACS endpoint.
**Steps:**
1. Find internal subdomain `uchat.uberinternal.com` via crt.sh wildcard `%.uberinternal.com`
2. Click SSO login, observe redirect to `/login/sso/saml` (OneLogin SAML)
3. Craft unsigned `<samlp:Response>` with `<saml:Assertion>` containing NameID, Email, memberOf=Administrator
4. POST it to `/login/sso/saml`
5. Server returns error 'Username attribute is missing' — proving signature was never checked
6. Add Username, Firstname, Lastname attributes and resend
7. Receive authenticated session as `noreply@uber.com` / Administrator
**How found:** Recon via crt.sh certificate transparency for internal subdomains; recognized OneLogin SSO/SAML flow and hypothesized signature validation might be missing, then tested with a minimal unsigned assertion and iterated on error messages.
**Exploitation:** Attacker posts a self-signed (unsigned) SAML Response to the ACS endpoint with arbitrary NameID/Email/role attributes; the SP creates an authenticated session, granting access to internal chat groups and impersonation of any employee.
**Escalation:** Setting memberOf=Administrator and arbitrary Email allowed impersonation of any Uber employee across channels.
**Insight:** Error messages that complain about missing attributes rather than invalid signature are a tell that signature verification is skipped — iterate on attribute errors to complete the assertion.