Vulnerability Report for JokerMix.to


Vulnerability Description:


A security flaw has been identified in the wallet creation process on JokerMix.to. This vulnerability allows an attacker to manipulate the letter of guarantee by injecting unverified content into the user address field.



Steps to Reproduce:

1. Generate a token for a PHPSESSID:
   - Send a POST request to /php-back/handle-capcha.php
   - Parameters: {"isChecked":1} (in JSON)
   - Note: The PHPSESSID should be set by the attacker in the header of subsequent requests.

2. Create a wallet with injected content:
   - Send a request to /php-back/create_wallet.php?
   - Use the PHPSESSID from step 1 in the request header
   - JSON parameters:
     {
       "userAddress": "1HsM2JbyKnqwcYvEm1kLMNwJtqb6uxSczd                     Vuln: I can add some content",
       "feeRate": 12
     }

3. The injected content appears in the signed letter of guarantee, demonstrating a lack of input validation.



Potential Impact:

This vulnerability could allow an attacker to:
- Inject malicious content into the letter of guarantee
- Potentially execute XSS attacks if the injected content is displayed without proper escaping
- Compromise the integrity and reliability of the mixing system



Recommendations:

1. Implement strict input validation for the user address field.
2. Use whitelists to allow only valid characters in cryptocurrency addresses.
3. Implement proper escaping when displaying generated content.
4. Review and strengthen the PGP signature verification process for the letter of guarantee.


Proof of Concept: Exploited Letter of Guarantee

The following is an example of an exploited letter of guarantee that is valid on the "Verify Letter of Guarantee" tool at bitmixlist[.]org:


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

jokermix.to
your session:
w_66d49d7fe8cc5

Payment Address:
bc1q2drz78efq5sftm0nhleallm4l0u3ff8wzpxx4m

User Address:
1HsM2JbyKnqwcYvEm1kLMNwJtqb6uxSczd                                                                                                                                                                                                                                                                             Vuln:                                                                                                        I can add some content

Additional Token:
OW0vQU1qakJ3T3d6VzVGZG94a3A3dz09OjpoYQ12kGa+HgHuTMZhrxYj

ONLY 1 TRANSACTION ALLOWED!
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEe6Z+7Cg5oBjn1AlyZNhbwXRysjUFAmbUnZcACgkQZNhbwXRy
sjURDgv9GH/RGgKGFgLd78A92kMH96plwzCYn9pGniT97HcPj/7LpmgdDrzZdSHt
0RYA1ncX8LJ84DhybxfItwCMxWgso2vBa1VtGhH6yYkFQWefdj9zkgbE1qFpG8nZ
8uLSg794X1G44WLzO1WiUk7qBfodan3bg2qImz/dx1eHQ0d4CkQJvlJ5MGQtPlvW
LHwOS5JUrlrTwC0PrfqabYHP2u0vhVzjV8SyukHToquZO8cHb7IHnA4k2pxdmB1q
XC+k+r5D0HDedLWI606VDDIFaJIjZcL4aqKjbmFZaqOrVJ+jVHT9gDCHsfBnngGC
ZsAMdWawpNQEBdWHkAY6yQy9bFzcO6JjeEOaG7tc3pLKWTFMypTS3E1P3EvA5832
PJa5zhSGSXEZkPov7QbdrI1Dhy0Ixbymq9tzg1bATq5PBTsrKu++uZMb48ivxVVb
z7/aX1EpPBtRgDxp1OtH6pB1HLjN4HgTJ9mnj4jvNqrqqjjSK0E+PQ9Z7JDK1PbC
ekx8e2Dj
=lvMZ
-----END PGP SIGNATURE-----

This letter of guarantee demonstrates the successful exploitation of the vulnerability, allowing arbitrary content to be injected into the user address field while maintaining a valid PGP signature.

Security Alert: Potential Privacy Issue on RoyalMix

Dear RoyalMix users and crypto enthusiasts,
I've recently uncovered a potential privacy issue in RoyalMix's mixing process that I'd like to share with the community.

The Issue:
When creating an order, RoyalMix verifies the validity of destination addresses using the BlockCypher API. However, their implementation unintentionally exposes the API token being used.

Consequence:
It would be possible for a third party to use this token to query the API call history, potentially compromising the anonymity of mixed transactions.

Technical Details:

• The issue is located in the 'submit-addresses.js' file
• The 'checkBitcoinAddressInBlockchain' function sends each address to BlockCypher with the API token in plain text
• API call: [https://api.blockcypher[.]com/v1/btc/main/addrs/${address}?token=${token}]

This information leak could theoretically allow for partial reconstruction of the mixing history.

Proof:
I've attached a screenshot to this post showing the hits (number of requests) passed through the BlockCypher API with this token. This concretely demonstrates the potential exposure of data.
[Screenshot of API hits][https://ibb.co/cCG15hp]

Call to Action:
I strongly encourage the RoyalMix team to:

• Review their implementation to protect the API token
• Consider safer alternatives for address verification

Note: This information is shared in a spirit of responsibility and transparency. The goal is to improve security for all users.[/list]