Shopify · Report #422707

Reflected XSS on $Any$.myshopify.com/admin

Validstatus

highseverity

$1,500bounty

58upvotes

13 Nov 2018disclosed

How it was found

Hi, I have found a reflected cross site scripting vulnerability in <any>.myshopify.com/admin through return_url parameter .

1-Go to https://<Any>.myshopify.com/admin/authenticate?return_url=javascript:alert(100)// 2-Click on reload this page 3-Xss alert message

Xss attack in <Any>.myshopify.com/admin

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original