Shopify · Report #910300
Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation
Summary
On June 28th, @say_ch33se reported that it was possible to bypass Shopify's email verification for legacy accounts. Doing so would have allowed a user to access accounts they did not own.
Our team immediately deployed a change to address this issue. Additionally, we have removed the ability to verify email addresses for legacy accounts. A code to confirm email ownership at the time of merging from a legacy account is now required.
How it was found
Hello Shopify, I have found a bug by which I can verify any email on .myshopify.com, the bug is very strange but it works. Also I can take over the accounts but only the ones which do not have SSO.
To reproduce please follow the steps exactly as I written otherwise you will not be able to reproduce it.
Steps to reproduce:
-
Go to your partners account and make a store {F886149}
-
Go to your new store and don't verify email, then go to admin/settings/account/youraccountnumber {F886151}
-
Change your email to victims email(in my case [email protected]) {F886138}
-
Go to burps match and replace and replace your email with the email you want to takeover(in my case [email protected]) {F886137} {F886139} {F886140}
-
Refresh the account page so its updated with victims email {F886141}
-
Still on accounts page click on Upload photo and upload any photo and save {F886142}
-
After that uncheck match and replace, refresh and on accounts page change email to your email which you own so you can get a confirmation email {F886143}
-
In burp check match and replace again to replace your email with the email you want to takeover(same as above)
-
Go to your email which you own where is the confirmation link and click on it(in the browser where you are already logged in)
-
On that page where you verified email, upload another image {F886144}
-
Now click on Review accounts
-
Enter stores password and you'll be greeted with Shopify ID
-
Click on Set up Shopify ID {F886145}
-
And there you got it {F886146}
-
Click continue and set up password {F886147} {F886148}
-
Now you can access vitims store and partner account without any problems
Impact
Ability to confirm any email on your-store.myshopify.com and leverage SSO to take over accounts.