Shopify · Report #161991
Open Redirect possible in https://www.shopify.com/admin/
Validstatus
6upvotes
31 Aug 2016disclosed
Summary
To allow documentation pages to provide convenient links to shops' admin pages, requests to https://www.shopify.com/admin/* redirect the user to https://<shop-name>.myshopify.com/admin/*, where <shop-name> is filled in based on the value of the last_shop cookie.
Because input validation was missing, any last_shop value would be accepted, thereby allowing an open redirect to any domain.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.