CSRF in Connecting Pinterest Account

How it was found

Hi,

The connect to Pinterest function is vulnerable to CSRF. This allows an attacker to connect his/her pinterest account to the victim's shopify. Even if the victim has already connected a pinterest account, this will allow the attacker to replace the existing connected pinterest account with the attacker's own pinterest account.

#PoC Note: I have also attached screenshots showing each step

1. Victim(mshop2-2) already has Pinterest account connected.
2. Attacker(mshop3-2) doesn't have Pinterest account connected and attempts to connect a Pinterest account.
3. Attacker authorize the shopify app to connect to his Pinterest account.
4. Attacker intercepts the redirection back to pinterest-commerce.shopifyapps.com and drop the request. Attacker also captures the URL, e.g. https://pinterest-commerce.shopifyapps.com/auth/pinterest/callback?code=d0c18854a3359866774d479614081453d235962f
5. Attacker induces Victim to load the above captured URL.
6. Victim's connected Pinterest account has been replaced with the attacker's Pinterest account.

#Possible Fixes

• Make use of the state parameter in OAuth, which is used to prevent CSRF, when connecting to Pinterest.