Shopify · Report #56662
XSS - URL Redirects
Informativestatus
4upvotes
16 May 2015disclosed
How it was found
Hi! I found that https://[shop name].myshopify.com/admin/redirects is vulnerable to XSS To Reproduce:
- Click Add Url Redirect
- set page for redirect
- add redirects as: javascript:alert(document.domain) or data:text/html;base64,PHNjcmlwdD5hbGVydCgiY29va2llIHN0ZWFsOiAiK2RvY3VtZW50LmNvb2tpZSk7d2luZG93LmxvY2F0aW9uLmhyZWY9J2h0dHA6Ly93d3cuZ29vZ2xlLmNvbSc7PC9zY3JpcHQ+ (XSS and URL redirect)
- A new redirect link created
- Click on link
- XSS
Thanks Fr33d0m from vlazeg team