# Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter

Uber's bonjour marketplace RPC accepted arbitrary userUuid, leaking victim personal data and mobile auth token, enabling full account takeover.

- Payout: hidden
- Severity: high
- Program: Uber
- Found by: anandpingsafe
- Disclosed: 2019-09-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/542340
- Library page: https://bugbountylibrary.com/r/h1%3A542340
- Tags: area:web domain:api impact:ato impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** REST RPC endpoint bonjour.uber.com/marketplace/_rpc
**Root cause:** The getConsentScreenDetails RPC trusted the client-supplied userUuid POST parameter without verifying it belonged to the authenticated caller, returning another user's data and mobile auth token.
**Steps:**
1. POST to `https://bonjour.uber.com/marketplace/_rpc?rpc=getConsentScreenDetails`
2. Set the `userUuid` POST parameter to a victim's driver/rider UUID
3. Response returns victim personal data and the victim's mobile auth token
4. Use the leaked token to call mobile APIs as the victim
**Exploitation:** Attacker substitutes a victim's UUID into the userUuid parameter, harvests the returned personal data and mobile auth token, then replays the token against mobile APIs to act as the victim with full account access.
**Escalation:** Leaked mobile auth token escalates a read-only info disclosure into full driver/rider account takeover.
**Insight:** RPC-style endpoints that take an object identifier (UUID) as a parameter often skip ownership checks; probe consent/profile RPCs with another user's UUID and watch for embedded session or API tokens in the response.