Coinbase: Misconfiguration in 2 factor allows sensitive data expose

For some users, Coinbase was accidentally revealing the last 8 digits of a user's phone number on the 2FA modal instead of the last 4 digits. I found that 2 factor page disclose mobile number of user...

Coinbase: XSSI (Cross Site Script Inclusion)

Hi, https://www.coinbase.com/pusher/auth returns sensetive a json auth-token response that can be parsed by javascript JSON.parse from external site. this can easily be mitigated by putting // or // chars at the beginning of the json response and thus making functions like JSON.parse unable to ge...

Coinbase: Session Issue Maybe Can lead to huge loss [CRITICAL]

Hey Coinbase, I have some found some sessions issues linking your web and the coinbase wallet means the android application, So as the user authenticates from the android app An android device linked is shown on this page : https://www.coinbase.com/settings/securitysettings POC: 1 Open android ap...

Coinbase: Direct URL access to completed reports

Access to non-HTML contents such as CSV report is not restricted to authenticated users. Anyone would be able to access a CSV report by giving the direct URL and downloading it. The URL could be obtained from browser history. The following URL is an example...

Coinbase: The 'Create a New Account' action is vulnerable to CSRF

The request to create an account wallet doesn't validate if the request is originating from the user itself with the help of an anti-CSRF token. Step 1: Craft an HTML page with request to create a wallet in your accounts page. https://www.coinbase.com/accounts New Account Wallet Step 2: Open the...

Coinbase: Race condition allowing user to review app multiple times

There was a race condition present that would allow a user to review an OAuth application multiple times...

Coinbase: Potential for Double Spend via Sign Message Utility

Hi, There is an unlikely but theoretically exploitable vulnerability is caused by allowing users to sign messages with their addresses. So far I have not been able to exploit this, but I believe that it is exploitable. On coinbse.com, the user can see a list of their addresses here. When they cli...

Coinbase: XXE in OAuth2 Applications gallery profile App logo

upload svg photo XML based as App logo contain XML payload renamed to .jpg server start execute this XML payload or just watch this video "https://www.dropbox.com/s/wkba6f0wrax0wr8/xxe.mp4?dl=0" the same vulnerability was in https://www.coinbase.com/careers and reported by...

Coinbase: HTML injection in apps user review

just watch this video https://www.dropbox.com/s/360cytluyiw2ym9/HTMLI.mp4?dl=0 this about full fake login exploit https://www.youtube.com/watch?v=5iRylyJTzWc...

Coinbase: Stored-XSS in https://www.coinbase.com/

Coinbase was mistakenly allowing developers to set their website or developer URL to a javascript:// or data:// URL. This link would then be rendered into the OAuth authorization page and leave users vulnerable to XSS if they clicked on it...

Coinbase: Transactions visible on Unconfirmed devices

Pusher authentication did not take device confirmation into account. This would allow an attacker with a valid session but an unconfirmed device to snoop on pusher updates like incoming transactions. This issue was in the coinbase event notification Pusher, which allowed me to read notification o...

Coinbase: Balance Manipulation - BUG

Hello once again, I have discovered another balance manipulation bug. This time it is much more simpler, but basically has the same outcome. EXPLANATION: When you create basic standard Vault and transfer money from your Main Wallet to the vault the balance doesn't "lock up", which means that even...

Coinbase: SPF records not found

There is no TXT record in DNS zone that defines Sender Policy Framework entry for domain api.coinbase.com. These are the best practices and need to be configure in DNS records to protect your mail servers. using SPF records will help in spam filtering as SPF records does helps in verifying the...

Coinbase: User email enumuration using Gmail

Hi, Using Gmail it is possible to get the list of email addresses that use/have coinbase accounts. as a prerequisite: we will need a script to bruteforce a list of email addresses. consider this script: python import random values only contain small letters and numbers letters =...

Coinbase: OAUTH pemission set as true= lead to authorize malicious application

OAuth authorize button in the Coinbase Android App did not have the android:filterTouchesWhenObscured attribute set to true, which may have made it vulnerable to tap-jacking. Reported UI Redressing Clickjacking For Mobile application of Coinbase , attack scenario is same as...

Coinbase: Runtime manipulation iOS app breaking the PIN

I was able to bypass your pin protection by doing runtime manipulation in iOS app 1.Installed the snoop it in device 2.By going snoop it tool settings choose the coinbase app 3.I already set the the pin in coinbase app 4.Open the coinbase app it is asking for PIN 5.Now browsing the snoopit...

Coinbase: Two-factor authentication (via SMS)

Hello Coinbase Security Team I just found a problem in Two-factor authentication mechanism, here is the details and how to reproduce this issue: I have two accounts with two emails on coinbase.com i active 2FA on the both of two emails with this phone number +201066462288. From Chrome i will try ...

Coinbase: OAuth authorization page vulnerable to clickjacking

Due to a misconfiguration, the 'authorize' button on the OAuth authorization page was vulnerable to clickjacking. The bug was fixed by ensuring our OAuth-related responses included the same security headers including X-Frame-Options as the rest of the site...

Coinbase: Big Bug with Vault which i have already reported: Case #606962

All info was provided via email you guys asked me to put my case number here. Case 606962 im [email protected] on coinbase...

SendGrid Email Delivery Service Hack

SendGrid, which sells a cloud-based email delivery service, has admitted that the extent of a hack disclosed three weeks ago was much more serious than originally reported. The company said an employee account was compromised and used to access other systems that contained customer and employee...