Shopify · Report #420459
H1514 Stored XSS in Return Magic App portal content
Summary
Note: This report was submitted during our H1-514 live hacking event, which had an expanded scope compared to our public bug bounty program. The app mentioned in this report is not currently in scope for our public program.
How it was found
Summary:
Stored XSS vulnerability was found in return magic app portal content which executes in the application domain in https://services.alveo.io/dashboard-shopify/settings/portal/content
Description: It's been found that Return Magic app allows users to add HTML content to their return portal without sanitizing the HTML which makes it possible to inject malicious tags that can be used to execute arbitrary JavaScript through other users' sessions.
Steps To Reproduce:
- Install Return Magic app
- Navigate to
https://<shop>.myshopify.com/admin/apps/returnmagic - Open Settings tab from the top menu and then open Portal --> Content from the left menu
- For the textarea where you enter your portal content, click the Code icon and enter
Test <img src=x onerror=alert(2)>then click Save - Now each time a user opens the portal settings page,
alert(2)will be executed. - XSS also triggers in
https://services.alveo.io/portal/search?shop=<shop>.myshopify.com{F356974}
Impact
Through this vulnerability a malicious user will be able to execute JavaScript through other user's sessions' which allows him to do malicious actions such as stealing sensitive information, submitting requests that bypass csrf protection ..etc