Shopify · Report #1550400
Staff without Manage Themes permissions can update themes
Summary
Per our policy page, we accept Staff Member Permission issues that have one of the following impacts:
- Demonstrates the ability for a staff member to escalate their privileges to one of our Sensitive Permissions (Manage Settings, Manage Payment Settings and Themes).
- Demonstrates a direct financial impact on the Shop (The request made must directly result in the impact).
- Demonstrates impact on Buyer PII that the staff member isn't already authorized for.
This report falls under number 1 above as it demonstrated the ability of a staff member to escalate their permissions to Manage Themes permissions by visiting a vulnerable URL.
How it was found
Hey team, as per https://help.shopify.com/en/partners/dashboard/account-access#store-access only people with Manage themes can View and edit the theme listing, and upload a new version to the Shopify Theme Store but Manage public listings can only Manage apps, themes, and experts listings. not upload a new version to the Shopify Theme Store but when a Owner gives his STAFF permission of Manage public listings , he is able to upload a new version to the Shopify Theme Store by just going to the https://themes.shopify.com/services/v2/themes/submission/new
Shops Used to Test:
https://partners.shopify.com/2450201/
Steps To Reproduce:
- owner invites the STAFF with Manage public listings and STAFF accept it and Login.
- Now he goes to https://partners.shopify.com/2450201/themes but he won't have access to it so he directly went to "https://themes.shopify.com/services/v2/themes/submission/new"
███████ 3. and now he can Uploads a Theme file from the Partner side
and if these are wrong , let me know if there is any detailed version of Permission on Partners.shopify.com as Manage public listings is confusing to me a little because of my previous and this report.
Supporting Material:
Attached
Impact
Permission mis-configuration ,STAFF with Manage public listings permission can Upload Theme which is a feature for Manage themes