Shopify · Report #397088
Stored XSS on buy button
Validstatus
lowseverity
$500bounty
39upvotes
29 Sept 2018disclosed
Summary
@tony_tsep discovered a cross-site scripting vulnerability in the Buy Button sales channel. Currency amounts were not properly rendered, which could allow an attacker to execute Javascript in the context of the channel.
How it was found
I found an XSS vulnerability on buy button.
Steps to reproduce
Go to Settings > General > Store currency > Change formatting and add on "HTML with currency" the payload €{{amount}} "><img src=x onerror=prompt(document.domain)>
After that go to buy button and you will see that the payload triggers there.
Impact
A staff member can takeover another account.