Coinbase: Authentication Issue

Hello there, I noticed while creating Recurring payment while 2FA is enabled it asks a user to enter verification code. So when someone confirm the Reccuring payment a request is sent to : POST /recurringpayments/58087a3d6861ee015644fc48/confirm HTTP/1.1 Host: beta.coinbase.com User-Agent:...

Coinbase: Information disclosure of user by email using buy widget

In the Coinbase Buy Widget flow, we were displaying the last 4 digits of a user's phone number for verification purposes e.g. "we've send a code to xxx-1234". Industry standard seems to be 2 digits instead of 4, so we now mask all but the last 2 digits...

Coinbase: Information leakage on https://docs.gdax.com

docs.gdax.com was exposing the nginx version in error pages. We changed the nginx configuration to not report that information as a defense-in-depth measure...

Coinbase: coinbase Email leak while sending and requesting

Due to a bug first reported by another researcher, when one coinbase user sent bitcoin to another coinbase user, the receiving user had the sending user's email address silently added to their contact list. While this does not raise PII exposure concerns under our Privacy Policy, we felt it was...

Coinbase: window.opener is leaking to external domains upon redirect on Safari

Although Coinbase cleared window.opener on external redirects, it was not effective on WebKit-based browsers Safari since Safari's cross-origin security prevents the modification of window.opener of a child window if it lies on a different origin, yet still allows the child window to access...

Coinbase: Create Multiple Account Using Similar X-CSRF token

Multiple Accounts can be created using the similar X-csrf token ! I have tested and created around 45+ accounts in this way ! Take a look ! in attachment ! i have created account range from test1-test27 3 times ! File is also attached for tested creating accounts !...

Coinbase: Content Injection error page

poc url: https://images.coinbase.com/has.been.changed.to.https://images.attacker.com/,so.please.visit.https://images.attacker.com...

Coinbase: No authorization required in iOS device web-application

Hey, this is Ahsan Tahir! I've found a authorization issue in coinbase! :- Issue ======= When we login to coinbase using PC not authorized it asks for authorization using a link, which is sent to our email and we have to authorize it by clicking on that email; but, when we login to a iOS device...

Coinbase: No authorization required in Windows phone web-application

Hey, this is Ahsan Tahir! I've found a authorization issue in coinbase! :- Issue ======= When we login to coinbase using PC not authorized it asks for authorization using a link, which is sent to our email and we have to authorize it by clicking on that email; but, when we login to a windows phon...

Coinbase: Application error message

poc url:https://developers.coinbase.com/api/%e3h This page contains an error/warning message that may disclose sensitive information.The message can also contain the location of the file that produced the unhandled exception.This may be a false positive if the error message is found in...

Coinbase: Transaction Pending Via Ip Change

Hi , Wamim Here . I Normally Use my Account From My Country Ip Email But Last Some Days I Checked And Found That When I Change My Ip Before Login Or Sending that time I got Mail After The Money Send Kindly Note That From Normal Ip when You sent you received mail instant when money sent .but this...

Coinbase: Cookie not secure

The cloudflare cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie can only be accessed over secure SSL channels. This is an important security protection for session cookies...

Coinbase: User's legal name could be changed despite front end controls being disabled

Despite the front-end form fields being disabled, a user could still change his/her legal name by manually manipulating the form in developer tools, or by manually creating a POST request with the necessary parameter names and values...

Coinbase: Sending payments via QR code does not require confirmation

Coinbase pushed out a feature whereby scanning a QR code inside the Coinbase Mobile app would complete payments under 0.1BTC without further confirmation. Upon reviewing this report and further consideration of the possible security implications of this feature, it was reverted. This issue has a...

Coinbase: Email leak in transcations in Android app

When a user received bitcoin from another Coinbase user, it was possible for the recipient to see the sender's email address in the transactions list in the Android app, despite the fact that users are told their emails would not be shown to other users. test...

Coinbase: Inaccurate Payment receipt

This was a UI issue...

Coinbase: An adversary can overwhelm the resources by automating Forgot password/Sign Up requests

As Coinbase doesn't use CAPTCHA on publicly available forms such as 'Forgot Password' & 'Sign Up' , the requests can be automated to overwhelm the resources to result in denial of service for CoinBase or mail flooding of customers. The steps to reproduce the issue are as follows. Step 1: Browse t...

Coinbase: Misconfiguration in 2 factor allows sensitive data expose

For some users, Coinbase was accidentally revealing the last 8 digits of a user's phone number on the 2FA modal instead of the last 4 digits. I found that 2 factor page disclose mobile number of user...

Coinbase: XSSI (Cross Site Script Inclusion)

Hi, https://www.coinbase.com/pusher/auth returns sensetive a json auth-token response that can be parsed by javascript JSON.parse from external site. this can easily be mitigated by putting // or // chars at the beginning of the json response and thus making functions like JSON.parse unable to ge...

Coinbase: Session Issue Maybe Can lead to huge loss [CRITICAL]

Hey Coinbase, I have some found some sessions issues linking your web and the coinbase wallet means the android application, So as the user authenticates from the android app An android device linked is shown on this page : https://www.coinbase.com/settings/securitysettings POC: 1 Open android ap...