# Stored XSS on any page in most Uber domains

Two IDORs in Tealium let attackers reset any user's password/MFA and inject JS into Uber's tag container, yielding stored XSS across many Uber domains.

- Payout: $6,000
- Severity: high
- Program: Uber
- Credited: mdv
- Disclosed: 2018-11-20
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/217739
- Library page: https://bugbountylibrary.com/r/h1%3A217739
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high technique:chained vuln:account-takeover vuln:auth-bypass vuln:idor vuln:mfa-bypass vuln:xss

**Target:** Tealium tag management platform (tags.tiqcdn.com/utag/uber/*)
**Root cause:** Tealium exposed IDOR endpoints allowing any user to reset another user's password and MFA, and to modify tag containers belonging to other accounts without authorization checks.
**Steps:**
1. Identify Tealium account/user endpoints lacking authorization checks
2. Use IDOR to reset a Tealium user's password and MFA via crafted requests
3. Log in as the compromised user and access their tag container
4. Inject arbitrary JavaScript into `https://tags.tiqcdn.com/utag/uber/*`
5. Load any Uber page that includes the tampered tag container to trigger stored XSS
**How found:** Researcher examined Tealium's user management and tag container endpoints, noticed missing authorization checks allowing cross-account actions, and tested resetting credentials and modifying another account's tags.
**Exploitation:** Attacker used IDOR to reset a Tealium user's password and MFA, took over the account, modified the Uber tag container to include malicious JS, which then executed on every Uber domain loading that container.
**Escalation:** Chained two IDORs (password/MFA reset + container modification) into account takeover and stored XSS across multiple Uber domains.
**Insight:** Third-party tag managers are high-leverage XSS targets: a single compromised container executes on every domain that includes it, so audit IDORs in SaaS tag/analytics platforms integrated across a target's estate.