Shopify · Report #185826
XSS in my.shopify.com in widget
Validstatus
mediumseverity
$500bounty
5upvotes
21 Jul 2017disclosed
Summary
The researcher observed that product descriptions were not properly sanitized when displayed inside the Buy Button channel.
How it was found
Hi security team I found XSS in the Buy Button in my.shopify.com
Step to reproduce
1-Go to Product and create Product with these payload <img src="a" onerror="prompt(document.cookie)" />; See (Step1)
2- Now Go to Embed on a website and in the buy bouton page chose the third template and XSS will pop up
Patch it