The popular ride sharing application Uber has come under scrutiny after security researcher and bug bounty hunter Seif Elsallamy identified a critical email vulnerability that Uber has yet to patch. He reported the bug to Uber on December 21st, 2021, however his report was labeled “out-of-scope,” alleging that exploitation of this vulnerability would require social engineering. The flaw stems from HTML injection in an exposed Uber server endpoint. The exploitation of this vulnerability would enable any attacker to send emails on Uber’s behalf, and these messages would appear completely legitimate since they would originate from Uber’s own servers. The fact that these emails have the necessary header data to mimic a legitimate Uber email, means that they will automatically pass spam/junk filters, and passed both the DKIM and DMARC security checks. Elsallamy demonstrated the exploit to researchers from BleepingComputer by sending them an email asking for credit card information. Upon clicking “Confirm”, the form submitted all of the text to Elsallamy’s lab command-and-control (C2) site. The successful exploitation of this flaw means that a threat actor could potentially send targeted phishing scams to 57 million Uber users/drivers email addresses from the 2016 Uber data leak. This specific bug has been reported to Uber as part of their bug bounty program, once as far back as 2015/2016. Employees and users of Uber are urged to exercise caution when interacting with emails from the company, and the standard safety checks for identifying phishing emails should be applied to every email. The Ankura CTIX will continue to monitor this matter, and if a patch or some other type of mitigation technique becomes available, an update will be published.