Shopify · Report #286667

Self-XSS in password reset functionality

Validstatus

lowseverity

35upvotes

10 Nov 2017disclosed

Summary

While the reporter identified this as an HTML injection, during our investigation we confirmed this was actually an XSS vulnerability but would have required a target to copy and paste a payload themselves. We made an exception to reward this self-xss with our minimum bounty given this occurred on accounts.shopify.com.

How it was found

Hi, When I opened this domain of yours, https://accounts.shopify.com/password-reset/new

I just put the following text into email address box,

<h1 style="color:blue;">█████</h1> it change the colour of the text.

Well my point here is that if you could inject HTML, you might be able to add a <form> tag to the page. I also upload the picture as a proof.

Peace.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original