Shopify · Report #169759
Open redirect in bulk edit
Validstatus
28upvotes
4 Dec 2016disclosed
How it was found
Hi ,
I have found an open redirection issue when bulk editing resources.
#PoC:
Go to https://<shop>.myshopify.com/admin/bulk?resource_name=Product&return_to=/..//evil.com then click the Close button and you'll go to evil.com
Thanks!