# Reading Uber’s Internal Emails [Uber Bug Bounty report worth $10,000]

Unclaimed SendGrid Inbound Parse webhook for em.uber.com let the researcher receive all email sent to Uber subdomains, including Sentry logs.

- Payout: $10,000
- Severity: high
- Program: Uber
- Credited: Rojan Rijal
- Disclosed: 2016-09-05
- Write-up quality: 7/10
- Original: https://web.archive.org/web/20200822010745/https://whitehatnepal.tumblr.com/post/149985438982/reading-ubers-internal-emails-uber-bug-bounty
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200822010745-https-whitehatnepal-tumblr-com-post-149985438982-reading-ubers-internal-emails-uber-b
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:high tech:email technique:recon vuln:info-disclosure vuln:misconfiguration vuln:subdomain-takeover

**Target:** SendGrid Inbound Parse Webhook / MX records for uber.com subdomains
**Root cause:** Uber's subdomains had MX records pointing to mx.sendgrid.net but the corresponding domain was never claimed in SendGrid's Inbound Parse, so any SendGrid account could register it and receive mail.
**Steps:**
1. Notice em.uber.com CNAME/MX points to SendGrid (mx.sendgrid.net).
2. Sign up for SendGrid, find Inbound Parse Webhook feature.
3. Add em.uber.com (and other uber.com subdomains) as inbound parse domains.
4. Run SendGrid's sample Python inbound-parse app on port 5000, expose via `ngrok`.
5. Point the webhook to the ngrok URL; emails to em.uber.com are POSTed to the local server and printed.
**How found:** After a public subdomain takeover disclosure, a colleague flagged em.uber.com's SendGrid CNAME. Researcher signed up to SendGrid to understand domain claiming; a password reset email revealed reply-to @em.uber.com, and MX lookup confirmed mx.sendgrid.net, prompting him to check Inbound Parse.
**Exploitation:** Researcher registered Uber subdomains in his own SendGrid Inbound Parse, tunneled a local HTTP receiver via ngrok, and received all mail addressed to those subdomains, including Sentry crash-report emails from www.uber.com.
**Escalation:** Extended from em.uber.com to all uber.com subdomains, capturing Sentry logs from www.uber.com for broader info disclosure.
**Insight:** Subdomain takeover checks should include MX/inbound-email services (SendGrid Inbound Parse, Mailgun routes), not just CNAME web hosting; an unclaimed inbound parse domain lets an attacker silently receive all mail for that domain.