News for hackers. Stuff that matters.

A comment on I Got Paid $0 from the Uber Security Bug Bounty. Parent comment

Re:I Got Paid $0 from the Uber Security Bug Bounty by GregoryVPerry on Sunday December 24, 2017 @02:40PM (#16000961)
Initially JavaScript was being escaped with their WAF.

The second POC demonstrated the ability to evade both their WAF and XSS_Auditor.

Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host.

That's pretty much the whole story.

[ Parent | on HN ]
Re:I Got Paid $0 from the Uber Security Bug Bounty by fredericoqq on Sunday December 24, 2017 @02:44PM (#16000986)
Could you make an alert(1) or not?

If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?

[ Parent | on HN ]
Re:I Got Paid $0 from the Uber Security Bug Bounty by netsec_burn on Sunday December 24, 2017 @02:53PM (#16001026)
Now I'm starting to wonder the same thing, *.cloudfront.net is not Uber.
[ Parent | on HN ]