Stored XSS on apps.shopify.com

How it was found

Steps to reProduce:

1> Write payload luc1d"><img/src="x"onerror=alert(document.domain)>@wearehackerone.com as Store contact email in General Settings page(*.myshopify.com/admin/settings/general)

{F1202181}

-- Wait here around 60 mins (maybe more idk, it was 60 mins for me) for the change to reflect -- (You can confirm the change on here https://apps.shopify.com/shops/<shopId>) 2> Visit any app page like https://apps.shopify.com/local-delivery 3> Click Get support link on sidebar {F1202116}

4> XSS will be triggered {F1202211}

PoC Video, {F1202215}

Impact

Stored XSS