# Chained Bugs to Leak Victim's Uber's FB Oauth Token

Uber's Facebook OAuth redirect_uri wildcard plus next_url and Referer-based logout redirect chained to leak victim's FB OAuth token, enabling account takeover.

- Payout: hidden
- Severity: high
- Program: Uber
- Found by: ngalog
- Disclosed: 2019-01-25
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/202781
- Library page: https://bugbountylibrary.com/r/h1%3A202781
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:account-takeover vuln:auth-bypass vuln:open-redirect

**Target:** Facebook OAuth flow on auth.uber.com / login.uber.com
**Root cause:** Facebook OAuth app allowed any redirect_uri matching `https://auth.uber.com/login?*`, and auth.uber.com's next_url plus login.uber.com/logout's Referer-based redirect let the token be bounced to an attacker site.
**Steps:**
1. Observe Facebook OAuth app accepts any `redirect_uri` matching `https://auth.uber.com/login?*`.
2. Add `next_url` to the redirect_uri: `https://auth.uber.com/login?next_url=https://login.uber.com/logout`.
3. Note `https://login.uber.com/logout` redirects based on the Referer header.
4. Craft single-URL PoC: Facebook OAuth prompt -> auth.uber.com/login?next_url=... -> login.uber.com/logout -> attacker site via Referer, leaking token.
**How found:** Researcher noticed the Facebook OAuth app's permissive redirect_uri pattern, then probed whether the `next_url` parameter could be appended to chain further redirects, and found login.uber.com/logout redirects on Referer.
**Exploitation:** Attacker sends victim a single crafted URL that triggers Facebook OAuth authorization, bounces through auth.uber.com and login.uber.com/logout, and redirects to the attacker's site with the victim's Facebook OAuth token in the Referer, enabling full account takeover.
**Escalation:** Chained three separate redirect weaknesses (OAuth redirect_uri wildcard, next_url param, Referer-based logout redirect) into one URL for token exfiltration.
**Insight:** When an OAuth redirect_uri allows a wildcard path/query, try appending internal redirect parameters (next_url, return_to) to pivot to other endpoints; also test logout endpoints for Referer-based redirects that can carry tokens.