Shopify · Report #709336
Reflective Cross-site Scripting via Newsletter Form
Summary
This is a reflective cross-site scripting in the newsletter signup feature of *.myshopify.com websites. It involves a filter bypass by using Ruby-on-Rails mass assignment to insert quotes (") which are not user supplied and therefore are not being filtered by the application.
This allows escaping the value attribute on an input tag to add an onfocus attribute which contains javascript and finishing it off with an autofocus to trigger the event on page load.
Extra spaces and square brackets "[]" were causing the payload to fail which made it difficult to retrieve sensitive data from requests to the admin panel. This was circumvented by using "split", "slice", "pop" and "shift" to move around the response data to grab administrative API keys from the /admin/apps endpoint.
How it was found
*.myshopify.com is vulnerable to a reflective cross-site scripting attack in the newsletter form. This can be crafted to trigger on a page load without any further user interaction.
The following example url shows this vulnerability:
https://testbuguser.myshopify.com/?contact[email]%20onfocus%3djavascript:alert(%27xss%27)%20autofocus%20a=a&form_type[a]aaa
This was tested on a newly registered store "testbuguser.myshopify.com"
If you require any additional details, please do not hesitate to bump.
Impact
This attack could be leveraged to compromise administrative sessions or perform actions on behalf of users with the same level of privilege as the user.