Deepcoin Disclosed Report

https://www.deepcoin.com/

DOM-based XSS vulnerabilities usually arise when JavaScript takes data from an attacker-controllable source, such as the URL, and passes it to a sink that supports dynamic code execution, such as eval() or innerHTML. This enables attackers to execute malicious JavaScript, which typically allows them to hijack other users' accounts.

To deliver a DOM-based XSS attack, you need to place data into a source so that it is propagated to a sink and causes execution of arbitrary JavaScript.

During analysis of the main deepcoin.com application I've discovered a DOM-XSS vulnerability which leads to account takeover of all registered users by the provided link.

To reproduce this issue, navigate to registration form with the following link:

https://www.deepcoin.com/en/register?status=reg&continue=javascript%3Aalert%28localStorage.getItem%28%22token%22%29%29

It contains a JavaScript payload which alerts an Auth token while the user is registered. With this attack, all Auth tokens of new registered users by the mentioned above can be easily exfiltrated. Here's an example of alert with the Auth token exfiltrated from the localStorage.

According to my investigation, the Auth token stays alive for several days, which means that attacker can silently persist in the victim account and run malicious actions. Also, all personal data, like IP, country, Full name are can be stolen as it located in the localStorage.

The vulnerability should be fixed soon.

The video PoC will be attached below:

https://drive.google.com/file/d/1UKG78-CRQQDof42TfJRPGdkc_TuFompK/view?usp=sharing