# CBC "cut and paste" attack may cause Open Redirect(even XSS)

Uber's Redirect.aspx encrypted target URLs with 8-byte-block CBC; a self-encryption oracle plus CBC cut-and-paste let an attacker forge a redirect to any domain.

- Payout: $500
- Severity: medium
- Program: Uber
- Credited: orange
- Disclosed: 2016-08-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/126203
- Library page: https://bugbountylibrary.com/r/h1%3A126203
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained vuln:crypto vuln:open-redirect

**Target:** Redirect.aspx URL-redirect endpoint with EQ ciphertext parameter
**Root cause:** Redirect target stored as raw CBC-encrypted URL with no integrity/MAC; the site also exposed an encryption oracle via ?uuid=, enabling ciphertext manipulation.
**Steps:**
1. Observe `Redirect.aspx?EQ=<hex>` decrypts to a URL; block size 8 => CBC/DES-like.
2. Find encryption oracle: `https://pages.et.uber.com/hangzhou1year/?uuid=1234` emits EQ ciphertext of the full URL in page source.
3. Encrypt chosen string `@orange.tw/?` via the uuid oracle to get a ciphertext block.
4. Splice that block into the EQ ciphertext (CBC cut-and-paste) so decryption yields a URL ending in attacker domain.
5. Request `Redirect.aspx?EQ=<forged>` and confirm redirect to orange.tw.
**How found:** Noticed EQ param was an encrypted URL, inferred CBC with 8-byte blocks from padding behavior, then searched for a page that reflects its own encrypted URL to serve as an encryption oracle.
**Exploitation:** Attacker uses the uuid page as an encryption oracle to obtain ciphertext for a controlled string, then cuts/pastes ciphertext blocks into the EQ parameter so the server decrypts to an attacker-chosen URL and issues a redirect; potential escalation to XSS via data: URI.
**Escalation:** Suggested chaining to XSS by redirecting to a `data:text/html;base64,...` URI.
**Insight:** When a redirect/state param is opaque ciphertext, hunt for any endpoint that encrypts user-controlled input and reflects the ciphertext (e.g. share/preview pages) — that oracle plus CBC block splicing forges arbitrary plaintext without the key.