Sidekiq dashboard exposed at notary.shopifycloud.com

How it was found

Summary:

Hi,

I found that the host https://notary.shopifycloud.com/ is exposing a sidekiq dashboard to the internet, for any unauthenticated user to use. I am not very familliar with Sidekiq, but from what I can tell its used for ruby background proccessing.

I am fairly certain this dashboard is used to manage shopify instances, since browsing to https://notary.shopifycloud.com/sidekiq/scheduled reveals a list of jobs which domains as arguments. I checked a few of the domains and they all seem to be shopify hosts.

I have not tried stopping any of the proccesses in order to not cause any downtime or issues to shopify hosts.

██████████

Impact

Stop workers & background processes for shopify hosts.