Shopify · Report #241008
Stored XSS in *.myshopify.com
Summary
The researcher reported an issue where any html typed in a input field in the Theme Editor would be instantiated in the document's DOM. We traced the issue to some creative sanitization code that attempted to fix unclosed html tags by doing something like document.createElement('div').innerHTML = value any time a onblur or onchange event was triggered on a input field in the Theme Editor. We've changed the offending code to run in a sandboxed iframe without script execution privileges.
How it was found
Hello,
First of all in noticed that this is out of scope "Any issue related to the storefront area being displayed in a <iframe> element in the admin area, for example in the Theme Editor."
This is not in the store front and this will be set in an XSS payload.
- Go to https://(YOUR SHOP).myshopify.com/admin/themes/THEME id)/editor
- Select header and scroll down to "annoucement text".
- Fill there as payload: "><img src="x" onerror="alert(document.cookie)">
- Click save and the XSS will be popped up.
I have checked it twice and it is not gonna reflect on the store front. This XSS is in the myshopify/admin section.
POC screen: https://snag.gy/FImTKd.jpg