Instacart: Image Upload Path Disclosure

Hi, Firstly,I couldn't see anything about Path Disclosure in your policy,so I've decided to report it. Steps to reproduce : 1-Create a list for a store 2-Add background image from link File has to be .svg like aaa.com/aaa.svg 3-Then it will give an error Let's take a look to that error...

Instacart: Server side request forgery on image upload for lists

Summary ---------- There is a Server-side request forgery when updating the image for a list. Steps to reproduce ----------------- 1. Create a list and change its image. That will send a POST request to https://beta.instacart.com/api/v2/lists/LISTID with the following parameters:...

Instacart: Missing rel=noreferrer tag allows link in list to change url of currently open tab

Hi, When adding links to lists, there is no rel=noreferrer tag present, allowing a linked page to change the url of the currently open tab. This can open the doors for phishing attacks, as users trust the tab that contained instacart. As an example, see my list at https://inst.cr/t/1QmLPG. Clicki...

Instacart: Cross-Site Request Forgery (CSRF)

Hello, i found Cross-Site Request Forgery CSRF that can change any user ZONE POC: put Zone you want send the request to any user and you will change his Zone Please Watch My POC I Attached For More Details Thanks...

Instacart: Stored XSS

First log in account. We headed to the "lists and recipes" option https://www.instacart.com/store/demo/lists create a new list "add list" Payload "alertdocument.domain URL pwned. https://www.instacart.com/lists/izy0w6Q?preview=true attached a screenshot...

Instacart: CSRF To change Email Notification Settings

Hi i found CSRF To change Email Notification Settings The Code Of the HTML Page :: For Fixing you Must add CSEF Token to the Request i attached Video Showing the Bug Thanks...

Instacart: CSRF with redeem coupon request

This behavior is working as intended. We have a number of fraud prevention mechanisms in place that limit the effects of a single entity abusing this feature...

Instacart: Authentication Bypass in Updating Personal Information

Hello Instacart, Firstly, I would like to remind you that I made this report by mail 2 days ago, Sat, 16-08-2016 before I got the invite here. Although a user is expected to input password before updating their personal information. This is not so anyway as I have found that one could actually...

Instacart: Authorization Bypass in Delivery Chat Logs

An authorization issue in the mobile app API allows any Instacart user to gain access to other users' order delivery chat logs. The /api/v2/orderdeliveries/:orderdeliveryid/orderchangelogs endpoint does not sufficiently check if the user has permissions to access that particular order's chat logs...

Instacart: Cookie-Based Injection

Hi Security Team instacart I'm Found Vulnerability Cookie-Based Injection It's may be possible to steal or manipulate session and cookies if attacker can injection XSS . details --- in path /help/ contain header in cookie paramter ahoyvisitor and ahoyvisit it's allow injection because re request...

Instacart: Cross-Site Scripting Reflected On Main Domain

Hi Security Team instacart I'm Found Have Vulnerability Cross-Site Scripting Reflected on Main Domain in Variable utmsource POC --- https://www.instacart.com/green-zebra-grocery?utmsource="'alert/Hussain/&utmmedium="'alert/XSS/&utmcampaign="'alert/injection/ Img :- http://i.imgur.com/wSn4EU7.jpg...