In early 2016, a security bug was reported to Uber, allowing remote code execution on rider.uber.com. This bug allowed an adversary to execute arbitrary commands on the Uber server. The bug was due to the insecure usage of a template engine. Let's explore what this security bug is and how to prevent it.
Back in early 2016, there was a problem found in Uber. It let people control the website 'rider.uber.com' from far away and do things they shouldn't. This bug could let anyone give orders to Uber's computer, and Uber gave $10,000 to the person who found it. The problem started with a weakness in the email service's special tool, and that's how they got in.
Let’s head to the lab to discover, debug, and fix this vulnerability within an actual application.
Many template engines do Output Sanitisation to protect against Cross Site Scripting. But using a template engine the wrong way can lead to worse things like remote code execution or secrets getting out.
