# [BBP系列三] Hijack the JS File of Uber's Website

Path traversal in Tealium's saveTemplate revision parameter let an attacker overwrite any account's utag.js, including Uber's, enabling JS hijack.

- Payout: $6,000
- Severity: high
- Program: Uber
- Credited: Chaobin Zhang
- Disclosed: 2018-12-03
- Write-up quality: 8/10
- Original: http://zhchbin.github.io/2018/12/03/Hijack-the-JS-File-of-Uber-s-Website/
- Library page: https://bugbountylibrary.com/r/blog%3Azhchbin-github-io-2018-12-03-hijack-the-js-file-of-uber-s-website
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:blog sev:high tech:cdn technique:recon technique:source-review vuln:path-traversal

**Target:** Tealium my.tealiumiq.com /urest/legacy/saveTemplate API
**Root cause:** The revision parameter is concatenated into a server file path without sanitizing ../ sequences, allowing writes outside the attacker's account directory.
**Steps:**
1. Identify Uber sites load `https://tags.tiqcdn.com/utag/uber/main/prod/utag.js` served by Tealium.
2. Register two Tealium accounts (attacker + victim).
3. POST `/urest/legacy/saveTemplate?utk=<token>` with `account=evilaccount&profile=main%00&type=profile&template=profile.loader&code=...` to leak the template path in the error message.
4. Switch to `type=revision&template=revision.loader&revision=201804081230` to confirm revision is embedded in path.
5. Inject traversal: `revision=201804081230/../../../../<victimaccount>/templates/main` to write utag.js into the victim account.
**How found:** Noticed Uber's sites load a third-party Tealium utag.js and asked whether its content could be modified; registered accounts and probed saveTemplate, using error messages to leak server paths and testing whether the revision value was path-concatenated.
**Exploitation:** Attacker with a free Tealium account overwrites the victim's utag.js via path traversal in the revision field; since Uber's sites load that file from tags.tiqcdn.com, arbitrary JS executes on Uber pages for all visitors.
**Insight:** Error messages that echo the constructed filesystem path reveal exactly where user input lands; when a parameter appears in a path, test traversal to escape your own tenant directory into other accounts on shared SaaS infrastructure.