# A $1,000,000 bounty? The KuCoin User Information Leak

KuCoin reverse-proxied /_api/zendesk/api/v2/* to Zendesk with admin auth, letting anyone list 276k support tickets and dump all user PII.

- Payout: $5,000
- Severity: high
- Program: -
- Credited: Corben Leo
- Disclosed: 2023-05-18
- Write-up quality: 7/10
- Original: https://corben.io/blog/hacking-kucoin
- Library page: https://bugbountylibrary.com/r/blog%3Acorben-io-blog-hacking-kucoin
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:rest technique:recon vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Zendesk API reverse proxy on www.kucoin.com
**Root cause:** The /_api/zendesk/api/v2/ path reverse-proxied arbitrary requests to kucoin.zendesk.com/api/v2/ while injecting the exchange's admin Zendesk credentials, so no client auth was required.
**Steps:**
1. Browse kucoin.com through Burp and notice `GET /_api/zendesk/api/v2/help_center/en-us/articles/6545352890265.json` returning Zendesk JSON
2. Confirm path passthrough with `GET /_api/zendesk/api/v2/` returning Zendesk 404 HTML
3. Request `GET /_api/zendesk/api/v2/tickets.json` -> 200 with 276479 tickets
4. Request `GET /_api/zendesk/api/v2/users.json` -> 200 listing all users' name/email/phone/role
5. Paginate via `?page=N` using next_page from responses to dump full dataset
**How found:** Noticed two 'api' segments in a proxied Zendesk help-center request, hypothesized a reverse proxy to Zendesk, then tested whether arbitrary Zendesk API paths passed through and whether admin auth was injected server-side.
**Exploitation:** Unauthenticated attacker sends plain GET requests to the proxy path; the backend authenticates as KuCoin's Zendesk admin, returning support tickets (PII, KYC attachments, session tokens, IPs) and the full user directory, exfiltrated via pagination.
**Escalation:** Used search.json to find session tokens in tickets, potentially enabling account takeover beyond the PII leak.
**Insight:** When a first-party path embeds a third-party SaaS API path (e.g. /_api/zendesk/api/v2/), test whether the proxy forwards arbitrary paths and injects the vendor's admin credentials — enumerate the vendor's full API reference against the proxy.