An interesting XXE in a popular product of Code42.com company, which could give access to backups of all users in a given company. The only option to break the service and get a bounty for pwning application was to find a 0day. Uber was using last version of product (5.2.0) of product, but not all customers have it installed. Since application was using Java, I knew I could read directories, and hence I immediately launched xxe-ftp server to extract data.”]
Source: https://httpsonly.blogspot.com/2017/01/0day-writeup-xxe-in-ubercom.html