Shopify · Report #1940245
Reflected XSS on help.shopify.com
Validstatus
lowseverity
$500bounty
111upvotes
25 Jan 2024disclosed
Summary
The returnTo parameter on help.shopify.com/en/support/confirm-account-details was vulnerable to XSS by using the javascript: protocol for the URL. In this case, the exploit relies on:
- an account being in an incomplete state
- the account holder clicking on the exploit URL
- the account holder logging into help.shopify.com
- the account holder clicking the continue button
How it was found
Summary:
Reflected Cross Site Scripting (XSS) on https://help.shopify.com/en/support/confirm-account-details?returnTo=
Platform(s) affected:
All platforms in other languages, exp:
Steps To Reproduce:
- Open the URL https://help.shopify.com/en/support/confirm-account-details?returnTo=javascript:alert(document.cookie)
- Make login
- Back again to https://help.shopify.com/en/support/confirm-account-details?returnTo=javascript:alert(document.cookie)
- Click on button "Continue"
- The JS will execute.
Notes:
- If the user already logged, just access the url and click on the button that the js will be executed.
- Also possible make a "Open redirect" when the user click on the button.
EXP:
https://help.shopify.com/en/support/confirm-account-details?returnTo=https://evil.com
Supporting Material:
Impact
The attacker can execute javascript code and redirect targets for others pages.