Shopify · Report #1256375
Blog posts atom feed of a store with password protection can be accessed by anyone
Summary
@xenx discovered a way of viewing the blog posts and product details of any online store which had a password page enabled. This was done without the need for any privileges by accessing an exposed atom feed which served blog and product data. The root cause of this was due to the fact that we were not validating the token included in the preview URL allowing for access to these resources. A change was shipped to properly validate the token in the preview URL.
How it was found
Hi shopify,
DESCRIPTION
I found a issue with blog posts atom feed of a shopify store. So without password we can't access the blog post atom feed at https://yourstore.myshopify.com/blogs/news.atom . But this can be bypass to access the atom feed of the blog posts.
For example try out this. I have added two blog posts in my store which can't be access through https://testcheckagain.myshopify.com/blogs/news , it will just redirect you to password page or accessing atom feed give you 401 error at https://testcheckagain.myshopify.com/blogs/news.atom. But it can be bypassed to check it at https://dummytext2showpoc-55204085816.shopifypreview.com/blogs/news.atom . So preview link can be exploited to get the atom feed of blog posts of password protected store. It can't be exploited for a partner development store.
STEPS
- Create a store at shopify.com
- Add a blog post and make it visible.
- If try to check the blog post atom feed in a different machine you will be thrown
401 error. - To bypass this try this link
https://dummytext2showpoc-store_id.shopifypreview.com/blogs/news.atom. - You can the access atom feed
Impact
Disclosing atom feed of blog posts of password protected store