apps.shopify.com - CSRF token leakage through Google Analytics

How it was found

#Description: When a user tries to send a support a message to an app developer in apps.shopify.com , he will be asked to login and once he is logged in , he will be redirected to apps.shopify.com/[app_id]?authenticity_token=[current_user_authenticity_token]. Developers can track their app page view in apps.shopify.com by adding a google tracking code while editing their app.

With that said , here is how now attacker can steal someone's CSRF token and use it to submit requests on behalf of that user:

• Attacker tricks the victim to visit an HTML page that he has control over it
• The HTML page opens a new window that redirects to https://apps.shopify.com/[attacker's_app]/support_interactions/new
• The victim will be redirected to https://apps.shopify.com/#login once he is logged in , he will be redirected to https://apps.shopify.com/[attacker's_app]?authenticity_token=[victim's_token]
• The attacker can now see the victim's authenticity token by checking Real-Time analytics at his google analytics dashboard
• The attacker can use the victim's CSRF token to forge HTML requests that edit the victim's app listing by issuing requests to https://apps.shopify.com/services/shopify_applications/edit , if the victim has a shopify application or he can use it to submit reviews,support messages ..etc

#Steps to reproduce:

1. Go to https://app.shopify.com/services/partners/api_clients/new to create a new application then after creating it click Edit App Listing and at Google analytics code field enter your google analytics code.
2. Go to https://apps.shopify.com/[your_app_id]/support_interactions/new , you'll be redirected to the login page , enter your shop domain then login.
3. After logging in you'll be redirected to https://apps.shopify.com/img-src-x-onerror-prompt2?reveal_support=true?authenticity_token=[Your_CSRF_TOKEN]&utf8=%E2%9C%93
4. Now go to your google analytics dashboard https://analytics.google.com/analytics/web/ -> Real Time analytics , and you'll see the whole URL with the authenticity token disclosed.

{F149974}