Reflected XSS In Marketing Reports Page On *.myshopify.com/admin

Summary

Please note: Storefront XSS is listed as a Known Issue on our policy page and the vast majority of storefront XSS reports received on our program are closed as Not Applicable.

The return_page_pathname querystring parameter on the following URL was vulnerable to XSS by using the javascript: protocol:

https://[YOUR-SHOP].myshopify.com/admin/marketing/reports/[MARKETING-CAMPAIGN-ID]?return_page_pathname=%2Fadmin%2Fmarketing&return_page_title=Marketing%20overview

Attack Complexity was assessed as high, because there are specific conditions for this XSS to successfully execute.

For example:

https://[YOUR-SHOP].myshopify.com/admin/marketing/reports/[MARKETING-CAMPAIGN-ID]?return_page_pathname=javascript:alert('xss')&return_page_title=Marketing%20overview

To be impacted, an authenticated staff member would need to:

1. Visit a link with an XSS payload in the link
2. Click the back button before the page is fully loaded.

There is a reflected XSS vulnerability in the Shopify marketing reports view page, which would allow an unauthenticated attacker to execute arbitrary javascript on any Shopify admin store. This is done via a unique URL payload being created by an attacker and sent to a Shopify user directing them to the marketing reports page, which will execute the javascript payload upon the user hitting the back button after the page is loaded. This parameter was meant to provide context on where the user should return to after attempting to go back, but could be manipulated to execute javascript via the returned response containing the attacker payload in the anchor's href value.

When the victim hits this back button on the marketing report page after loading, instead of returning them to their marketing page as it should, it will execute the XSS payload inserted by the unauthenticated attacker, making this vulnerability able to affect all Shopify stores and users who receive the link.

This page contained lots of valuable information for the specific user and could have been used to gather sensitive user data, execute actions as the victim, and much more.