Shopify · Report #2886723
GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)
Summary
This report identified that GraphQL introspection was enabled on a Shopify storefront GraphQL endpoint, allowing complete schema information including query types, fields, and mutation operations to be retrieved.
The concern raised was that this could potentially lead to unauthorized API access by revealing the full API structure to unauthenticated users.
Shopify has confirmed that GraphQL introspection is intentionally enabled by design and is not considered a security vulnerability. Shopify encourages security researchers to use schema information to help identify legitimate security issues, as noted in the program policy.
It's important to note that Shopify's bug bounty program guidelines require researchers to only test against stores they have created themselves using their HackerOne email address. Reports involving merchant production stores when the same issue could be reproduced on a test instance are ineligible submissions.
How it was found
Summary:
Hi team ! i've found a misconfiguration in your graphql Api on the endpoint << https://██████/api/unstable/graphql.json >>in which an attacker is able to run a graphql interospection query to fetch schemas , types , fields , available query operations , after running interospection query on the graphql api endpoint , an attacker is able to list all type of available api calls , so he'll be able to perform unauthorised api calls due to this misconfiguration.
Interospection>>
"query":"query IntrospectionQuery { __schema { queryType { name } mutationType { name } subscriptionType { name } types { ...FullType } directives { name description args { ...InputValue } } } } fragment FullType on __Type { kind name description fields(includeDeprecated: true) { name description args { ...InputValue } type { ...TypeRef } isDeprecated deprecationReason } inputFields { ...InputValue } interfaces { ...TypeRef } enumValues(includeDeprecated: true) { name description isDeprecated deprecationReason } possibleTypes { ...TypeRef } } fragment InputValue on __InputValue { name description type { ...TypeRef } defaultValue } fragment TypeRef on __Type { kind name ofType { kind name ofType { kind name ofType { kind name } } }
Steps To Reproduce:
<<< shops.myshopify.com Aliassees: ████ >>> ██████
- navigate to the endpoint https://███/api/unstable/graphql.json
- visit to the endpoint and capture the request in burp proxy and send the request to repeater
- now put the interospection query into the request body and send the request
- after the in the response you'll get types of query operation's available , schemas so that by using these an attacker will be able to perform unauthorized call
███
Similarly there are too many types of query operations available see in the below screenshot :
███
Here in this scenerio the mutations is also available to modify a data on the graphql api , see in the below screenshot that after running a interospection query it has revealed the mutations availabe so the attacker can craft a query to modify the data :
██████
████████
here the issue is the , due to the misconfiguration in graphql api , it is allowing an arbitary user to run interospection query , so here the after running interospection query it is revelaing the api calls available which is a not a good security implimentation and you must have to forbid the user to run a interospection query otherwise an attacker will be able to perform unauthorised api calls .
- [attachment / reference]
#1132803 #291531 #423388 #645299
Impact
if attacker will get available query operation types , fields , mutations so an attacker will be able to modify and list the data and will be able to perform unauthorised api calls