# XSS In archive.uber.com Due to Mime Sniffing in IE

archive.uber.com mirrored PyPI tarballs served as octet-stream; injecting HTML into a .tar.gz triggered IE MIME-sniffing XSS.

- Payout: $750
- Severity: medium
- Program: Uber
- Credited: ddworken
- Disclosed: 2016-04-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/126197
- Library page: https://bugbountylibrary.com/r/h1%3A126197
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:python technique:source-review vuln:xss

**Target:** archive.uber.com PyPI mirror serving .tar.gz files
**Root cause:** Server returns .tar.gz with Content-Type application/octet-stream and no X-Content-Type-Options; IE sniffs first 256 bytes for HTML and renders as HTML.
**Steps:**
1. Build tarball with `python setup.py sdist`
2. Edit the .tar.gz with `nano` to insert `<html><script>alert(0)</script></html>` near the start
3. Upload via `twine upload dist/evil.tar.gz` to PyPI
4. Wait for archive.uber.com mirror to pull the package
5. Open the mirrored .tar.gz URL in Internet Explorer to trigger `alert(0)`
**How found:** Noticed archive.uber.com mirrors PyPI tarballs with octet-stream MIME; reasoned that IE content-sniffs first 256 bytes for HTML, then tested by crafting a tarball with injected HTML.
**Exploitation:** Attacker uploads a malicious tarball to PyPI; Uber's mirror pulls it and serves it as octet-stream; victim opening the URL in IE executes injected JS in archive.uber.com origin.
**Insight:** When a target mirrors third-party package repositories, attacker-controlled artifacts (tarballs, wheels) become stored-XSS vectors on the mirror's origin if MIME is octet-stream and IE sniffing is enabled.