Uber fixes bug that exposed third-party app secrets

guest · Feb 20, 2019

Uber fixes bug that exposed third-party app secrets
February 20, 2019
https://techcrunch.com/2019/02/20/uber-third-party-apps-vulnerability/

Uber has fixed a bug that allowed access to the secret developer tokens of any app that integrated with the ride-sharing service, according to the security researchers who discovered the flaw.

In a blog post, Anand Prakash and Manisha Sangwan explained that a vulnerable developer endpoint on Uber’s back-end systems — since locked down — was mistakenly spitting back client secrets and server tokens for apps authorized by the Uber account owner.

Client secrets and server tokens are considered highly sensitive bits of information for developers as they allow apps to communicate with Uber’s servers. For its part, Uber warns developers to “never share” the keys with anyone.
Prakash, founder of Bangalore-based AppSecure, told TechCrunch that the bug was “very easy” to exploit, and could have allowed an attacker to obtain trip receipts and invoices.
Click to expand...

Log in or Sign up

Uber fixes bug that exposed third-party app secrets

guest Guest

Log in or Sign up

Uber fixes bug that exposed third-party app secrets

guest Guest

Useful Searches