Shopify · Report #1029668
Self xss in product reviews
Validstatus
mediumseverity
29upvotes
19 Nov 2020disclosed
Summary
@tomorrow_future reported an issue where an unauthenticated user could reflect JavaScript on a product page for a very small number of shop configurations. This issue did not fall under our typical Storefront cross-site scripting exclusion because the input is provided by a visitor to the store, not an authenticated administrator.
How it was found
1、install app Product Reviews
{F1070556}
2、Open a product and write a review
3、Press F12 on the keyboard，Change the type of email to text.
4、Write in email"><img src=a onerror=alert(1)>[email protected].
{F1070565}
5、Write other required fields，then submit. {F1070566}
Impact
Self xss