Shopify · Report #160047

[apps.shopify.com] Open Redirect

Validstatus

$500bounty

13upvotes

26 Sept 2016disclosed

How it was found

PoC https://apps.shopify.com//blackfan.ru/

HTTP Response

HTTP/1.1 301 Moved Permanently
Server: Cowboy
Date: Wed, 17 Aug 2016 11:48:27 GMT
Connection: close
Location: //blackfan.ru

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original