HexBrain

Shopify · Report #169759

Open redirect in bulk edit

Validstatus
28upvotes
4 Dec 2016disclosed

How it was found

Hi , I have found an open redirection issue when bulk editing resources. #PoC: Go to https://<shop>.myshopify.com/admin/bulk?resource_name=Product&return_to=/..//evil.com then click the Close button and you'll go to evil.com

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original