Automatic Instacart Bots

Instacart is taking legal action against bots that automatically place orders: Before it closed, to use Cartdash users first selected what items they want from Instacart as normal. Once that was done, they had to provide Cartdash with their Instacart email address, password, mobile number, tip...

Instacart: View & add to cart unlisted items via IDOR

Access Control vulnerability that would let an attacker order certain items from the API, even though they are missing from the Web catalog...

Instacart: CSRF Trial 14 days express subscription

Description ======== When a new user has been registered, Instacart pops up a message offering the user for a limited time 14 days express trial, in which the user may decide to skip and subscribe later on decision. The research has found that the express trial subscription endpoint does not...

Instacart: Get all instacart emails - missing rate limit on /accounts/register

Hey Instacart team, When signing up for an account, you enter your email. When this email is already in use, the server responds with ""errors":"email":"has already been taken"" This in not a problem, but the fact that you could send this request unlimited times is the issue. This way we can easi...

Instacart: Bruteforcing password reset tokens, could lead to account takeover

Hey Instacart security team, Description When resetting a new password on https://shoppers.instacart.com/password you will receive an email with a reset link. when clicking on this link. you go to this page: https://shoppers.instacart.com/password/edit?resetpasswordtoken=YourToken when entering a...

Instacart: XSS at in instacart.com/store/partner_recipe

Summary Hi team, i found that this endpoint - https://www.instacart.com/store/partnerrecipe? at param imageurl is vulnerable to XSS Reproduction Steps & PoC 1Go to...

Instacart: Login with Google Not Authenticated on iOS App

In your iOS application, there is Login with Google. In this, you're not authenticating a user properly and it can lead to access to user accounts. Affected API: https://www.instacart.com/api/v2/users/googleloginauth In this request, these are the parameters: accesstoken, clientid,idtoken,...

Instacart: XSS in instacart.com/store/partner_recipe

Please open the following url...

Instacart: Access private list metadata

Overview When user creates a list, they can choose to not make it public. However the attacker can still access the information that user chose to hide. Steps to Reproduce 1. Log in to Instacart. 2. Choose a private list that you want to see, for example the one with id = 10. 3. Go to...

Instacart: Full access to any list

Overview == The endpoint for adding a list collaborator lacks authorization checks. A regular Instacart user can add themselves as a collaborator to any list and thus get full control over that list. How to Reproduce == 1. Choose a list that you want to edit, for example the one with id = 10. 2...

Instacart: User Information sent to client through websockets

I noticed when monitoring the websocket requests that the account information of user, including userid is sent to the client. "t":"d","d":"r":8,"a":"p","b":"p":"/carts/3671079xjdJHqx88J435eDW5zxN/users/-KRbGN8R6uIjy6OPxj","d":"id":25390626,"name":"Username...

Instacart: Seemingly sensitive information at /api/v2/zones

Overview == https://www.instacart.com/api/v2/zones is accessible by a regular Instacart user and seems to return sensitive information such as names, emails, phone numbers, money amounts and dates. GET /api/v2/zones "meta": "code": 200 , "data": "zones": ... "id": 73, "name": "████", "createdat":...

Instacart: [Critical] Subdomain Takeover

Your Subdomains are pointing to unconfigured heroku app. You should immediately remove the DNS-entry. Any One Can Claim That Domain , Please Read The Advisory Below. ::: Nslookup of Subdomains Not Claimed ::::: i 0x00hack3r@pirateking: % nslookup bugs.instacart.com Server: 192.168.1.11 Address:...

Instacart: Fetch private list metadata and any user's personal name

Overview == When a user creates a list, they can choose whether to make the list visible in search and whether to show their name with the list. The problem is that the attacker can still access the information that the user chose to hide. Furthermore, if the attacker gets hold of a user's ID, th...

Instacart: READ .svg files by changing .svg into .png extension

Good Day, Instacart In list and recipe we could see that we can upload a picture . It won't accept .svg files but by changing it to .png. Steps to Reproduce 1. Create a list and recipe under accounts 2. Upload a picture. We will upload an svg but with a png extension. I've attached an svg file...

Instacart: API OAuth Public Key disclosure in mobile app

Our Android/iOS app can be decompiled and the OAuth Public token can be accessed. Contrary to Instacart's summary, the API private key is also leaked, allowing anyone to use Instacart's private API without restriction. Instacart which I have found to be great in general ignored my additional...

Instacart: Brute force login and bypass locked account restrictions via iOS app

When logging in to an account on the website, a user's account gets locked out after 15 tries to prevent an attacker from brute forcing access to the account. These same restrictions do not apply to the mobile sign-in endpoint a POST request to https://www.instacart.com/oauth/token, which allows ...

Instacart: Hyperlink Injection in Friend Invitation Emails

Description A user can change their name to a URL in order to send email invitations containing malicious hyperlinks. Steps to Reproduce 1. Create a new Instacart account with the first name http://example.com 2. Navigate to https://www.instacart.com/store/referrals 3. Send an email invitation to...

Instacart: Reflected File Download on recipe list search

Hi guys, Right now I'm searching for JSON issues on your API so I started to go deep into the XHR requests. When I noticed the following request:...

Instacart: shopper login_code's can be brute forced

Hi, I didn't see in the scope of your program, but it is a security weakness, so you must know this. If you don't care about shoppers' accounts then you can just mark this report as informative. First I tried to register a shopper account at https://shoppers.instacart.com/ Used a fake email addre...