[IODR] Get business trip via organization id
U
Uber
Submitted None
Actions:
Reported by
severus
Vulnerability Details
Technical details and impact analysis
Hi Uber,
I found issue on https://business.uber.com/server/organizations/[id]/trips2?per_page=15&requestAtStart=&requestAtStop=&count=true
Step to reproduce:
1. Get https://business.uber.com/server/organizations/[your_organization_id]/trips2?per_page=15&requestAtStart=&requestAtStop=&count=true
2. Chang to victim organization If valid id, it will return result, but if not it will show error with internal state
```
{"error":{"name":"TchannelUnexpectedError","fullType":"tchannel.unexpected","type":"tchannel.unexpected","message":"Unexpected Error: 'validation_error.must_be_a_valid_uuid_v4'","isErrorFrame":true,"codeName":"UnexpectedError","errorCode":5,"originalId":2,"remoteAddr":"10.160.14.41:21306"}}
```
In `employee_invites`, it return 403.
As previous I report #151465 , I can get organization id or just enum it ( very difficult).
Best regards,
Severus
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$2000.00
Submitted
Weakness
Improper Authentication - Generic