Shopify · Report #413759
Race condition at create new Location
Summary
@zhurig found a race condition where it was possible to bypass the limit for the number of locations a store can have by submitting multiple requests at once. We have resolved this issue by adding extra transactional locking during store location changes.
Note: Shopify no longer accepts reports regarding race conditions bypassing plan limits to this bug bounty program. Please make sure to check that your report has additional merchant impact beyond bypassing a plan limit before reporting.
How it was found
User can bypas restriction and create more ctore location, than maximum depends store plan. Intercept request and send it multiple at once. See screensots F350687 - requests F350688 - results I created 12 store location when 4 possible
Impact
Bypass the limitations of the billing plan