Shopify admin authentication bypass using partners.shopify.com

Summary

@uzsunny reported that by creating two partner accounts sharing the same business email, it was possible to be granted "collaborator" access to any store without any merchant interaction.

We tracked down the bug to incorrect logic in a piece of code that was meant to automatically convert an existing normal user account into a collaborator account. The intention was that, when a partner already had a valid user account on the store, their collaborator account request could be accepted automatically, with the user account converted into a collaborator account.

The code did not properly check what type the existing account was, and therefore an existing collaborator account in the "pending" state (not yet accepted by the store owner) would be converted into an active collaborator account, effectively allowing the partner to approve their own request without interaction from the store owner.

We fixed this issue by properly verifying that the exisiting account is in fact a user account.

Impact:

This bug allowed me to login to any store with full permissions.

First of all Thanks to shopify security Team for 20k bounty.

This bug was found on sep 23rd 2017 and within 1 hour the bug has been patched.

Thanks to shopify security Team for 20k bounty.

Thanks once again