On: I Got Paid $0 from the Uber Security Bug Bounty

[GregoryVPerry]

Initially JavaScript was being escaped with their WAF.

The second POC demonstrated the ability to evade both their WAF and XSS_Auditor.

Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host.

That's pretty much the whole story.

[fredericoqq → GregoryVPerry]

Could you make an alert(1) or not?

If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?

[netsec_burn → fredericoqq]

Now I'm starting to wonder the same thing, *.cloudfront.net is not Uber.