# Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com

Dangling CloudFront CNAME on saostatic.uber.com enabled takeover, leaking domain-scoped _csid SSO cookies to hijack auth.uber.com sessions and impersonate any Uber user.

- Payout: hidden
- Severity: critical
- Program: Uber
- Found by: arneswinnen
- Disclosed: 2017-07-13
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/219205
- Library page: https://bugbountylibrary.com/r/h1%3A219205
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical tech:cdn technique:chained technique:recon vuln:account-takeover vuln:auth-bypass vuln:subdomain-takeover

**Target:** auth.uber.com SSO / saostatic.uber.com CloudFront CNAME
**Root cause:** saostatic.uber.com had a dangling CNAME to an unclaimed CloudFront distribution, allowing takeover; Uber SSO issued _csid session cookies scoped to domain=.uber.com, so any *.uber.com subdomain could receive them.
**Steps:**
1. `nslookup saostatic.uber.com` shows CNAME to `d3i4yxtzktqr9n.cloudfront.net` returning CloudFront error (unclaimed).
2. Create new CloudFront distribution with attacker origin and claim hostname `saostatic.uber.com`.
3. Victim logged into auth.uber.com visits attacker page (e.g. iframe) loading `https://saostatic.uber.com/prepareuberattack.php`.
4. Attacker starts own login flow at riders.uber.com to obtain valid `state=CSRFTOKEN` and state cookie.
5. Relay auth.uber.com URL to victim so victim's browser generates `_csid` for attacker's state values; hidden request to saostatic.uber.com exfiltrates `_csid`.
6. In attacker browser, intercept login request, inject stolen `Cookie: _csid=...`, forward; response redirects to riders.uber.com/trips as victim.
7. Copy `Set-Cookie` lines from exfil page into attacker browser response to complete session.
**How found:** Noticed saostatic.uber.com CNAME pointed to CloudFront but returned an error page, indicating unclaimed distribution; then analyzed the SSO cookie flow diagrams and observed _csid is ignored (not cleared) when victim already logged in, keeping it alive for theft.
**Exploitation:** Attacker takes over dangling subdomain, then lures an authenticated victim to load a page on it (iframe), which triggers a login flow whose _csid cookie is scoped to .uber.com and leaks to the attacker. Attacker pairs it with a self-obtained CSRF state token to complete SSO login as the victim across all *.uber.com service providers.
**Escalation:** Chained subdomain takeover + shared-cookie SSO + CSRF-state relay to convert a low-impact dangling DNS into full account takeover on any *.uber.com property.
**Insight:** When SSO uses domain=.uber.com cookies, any *.uber.com subdomain (even out-of-scope, externally managed ones) becomes an ATO vector; check dangling CNAMEs on cookie-scoped subdomains and whether SPs fail to invalidate stale shared cookies when a user is already logged in.

## Proof of concept (copied exactly from the original report)

**nslookup showing dangling Cloudfront CNAME**

```
# nslookup saostatic.uber.com 8.8.8.8
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
saostatic.uber.com	canonical name = d3i4yxtzktqr9n.cloudfront.net.
```

**PoC steps to hijack victim session**

```
1. Open the victim's browser & browse to https://riders.uber.com . After being redirected to https://auth.uber.com , login with the victim's credentials so you end up on https://riders.uber.com trips dashboard again.
2. Open a second browser tab in the victim's browser and browse to https://saostatic.uber.com/prepareuberattack.php . Accept any certificate warnings that you may receive here - again, we're only simulating that the domain has a valid SSL certificate. Once the page has finished loading you should see a URL, "Cookie: " string and a "Set-Cookie: " strings underneath each other. This is all info gathered under the hood by the attacker's webserver that is required to login as the victim now.
3. Open the separate attacker's browser and setup an intercepting proxy tool to intercept requests and responses. Browse to the URL displayed on the prepareuberattack.php page output and intercept this request. Now copy the "Cookie: ..." string displayed on prepareuberattack.php and paste it into the request headers. 
4. The response should be a redirect to https://riders.uber.com/trips, indicating successful authentication bypass. Last but not least, copy all the "Set-Cookie: " lines from the prepareuberattack.php page output and paste them in the response before forwarding it to the browser. This ensures that the stolen cookies are properly injected in the attacker's browser. 
5. You are now logged in as the victim in the attacker's browser
```