Is Carex Auto safe?
Carex Auto sends Copart and IAAI login usernames, with IP and location, to auctiongate.io for guest users.
On Copart and IAAI login pages, the extension reads the username from the login request and, after a successful login by a user not signed in to its own product, sends it with IP address, ISP and geolocation to auctiongate.io. It also uploads manheim.com cookies to the same backend after login, and reports page URL, buyer number and a browser fingerprint on Copart and IAAI auction pages.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.
Shared hosts - 20 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Copart and IAAI login usernames sent with IP and location to auctiongate.io
Code analysis shows the extension reads the username typed into Copart or IAAI login forms and posts it with IP, ISP and location to auctiongate.io when you are not signed in to the vendor product.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You log in to Copart or IAAI while not signed in to the extension's own product.
The extension sends your auction username, IP address, ISP and location to auctiongate.io.
The request fires after the login redirect succeeds.
Username capture and gated upload
Equivalent logic
// on POST to login URL:// copart: username = JSON.parse(body).username// iaai: username = formData['Input.Email'][0]// store currentGuestDTO = {userName, host}// on 302 login-success redirect:// if (!is_auth) {// ip = await getIPInfo()// POST multipart(app_user_name, user_ip, user_isp, city, region, country, lat, lon, ...) to /api/v1/auction-auth-log// }- Auction usernamejsmith@example.com
Login name or email typed into the Copart or IAAI form
- IP address203.0.113.24
Your public IP from the extension's IP lookup
- ISPExample Telecom
Your internet provider name
- City, region, countryAustin, Texas, US
Approximate location from the IP lookup
- Latitude and longitude30.2672, -97.7431
Coordinates returned by the IP lookup
- Previous app user idslast_app_user_id: 48213
Last user name, company id, user id and login date stored by the extension
- User agent and platformWindows
Browser string and operating system
- api_token<redacted>
Token the extension attaches to authenticate to its backend
- auctiongate.io
Receives the login username with IP, ISP and location via /api/v1/auction-auth-log
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Carex Auto contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- auctiongate.io
Carex Auto sends data to auctiongate.io. 10 other extensions we have analysed send data here.