HexBrain
Open on HackerOneSign in

Shopify · Report #226428

Reflected XSS in <any>.myshopify.com through theme preview

Validstatus
69upvotes
29 May 2017disclosed

Summary

This is a reflected XSS that could be triggered on the storefront of any Shopify store. Our template was missing proper escaping for the theme_handle parameter. This issue is severe because it could be exploited by unauthenticated users to attack the admin area of a store, given that the storefront is hosted on the same origin as the admin area of a store.

How it was found

Hi, I have found a reflected cross site scripting vulnerability in <any>.myshopify.com through theme_hanlde parameter due to not single quotes.

#Steps to reproduce:

  1. Navigate to <account>.myshopify.com
  2. view the source of the page and copy the value of Shopify.theme Id.
  3. Navigate to https://echo.myshopify.com/?theme_handle=xx%27-alert(document.cookie)-%27&style_id=1&style_handle=1&preview_theme_id=<theme_ID>

replace <theme_ID> with the ID you just copied.

  1. XSS will trigger in all of the online shop pages unless you click Cancel theme preview .

PoC: https://test.myshopify.com/?theme_handle=xx%27-alert(document.cookie)-%27&style_id=1&style_handle=1&preview_theme_id=3572

{F182252} Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original