Shopify · Report #1162443
No Session Expiry after log-out, attacker can reuse the old cookies
Summary
A session fixation vulnerability was discovered in Shopify's Exchange Marketplace, a service which has been decommissioned. An attacker with physical access to a shared computer could steal session cookies and authenticate to the Exchange Marketplace as the victim. The service is no longer in use and the issue is resolved.
How it was found
Hi, There is no session expiry after log-out which can help an attacker to take-over the full account by reusing it.
Reproduction Steps
- Go to https://exchangemarketplace.com/ and click on Sign In
- Continue with Google Account
- Use "EditThisCookie" Extension to export the cookies
- Once you logged in - click on "EditThisCookie" Extension and export the cookies
- Now open another browser and import those cookies - you can able to login an account by using cookies
- Logout from your first browser - it should logout from another browser as well.
- Now, login again with your google account - This time use old cookies.
- By using old cookies, you can able to login victim's account. (Whenever victim's session is active)
Please find the attached POC video ████████
Impact
Attack Scenario: If a malicious user gets the victim's cookies by exploiting any vulnerability, he can log in to victim's account . Whenever the victim's session is active an attacker can login victim's account by using old cookies.
Impact: If a malicious user gets the cookies by exploiting any vulnerability, he can log in to the victim's account.