Shopify · Report #94899
Paid account can review\download any invoice of any other shop
Summary
This bug allowed users to view the monthly invoice of other stores by changing the store id in the URL. The invoice contained the full name and address of the store owner, as well as all line items for the invoice.
How it was found
Hi Shopify Team I would like to report serious security issue within admin panel of Paid Myshopify account Paid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it. In web variant of invoice, financial details revealed. **In PDF variant - address of web shop, owner's email and all billing information [name\address\money amount etc] disclosed **
POC:
-
Authenticate in Paid [not Developer] Shop as Shop Owner
-
Go to invoices and alter url by changing invoice number at the end of URL:
hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632 -
To download PDF and review other paid user's data, use link:
hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf
Please note, that due to limitation of Developer's account, this test cannot be performed on Dev store. I also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy. If anyway more details needed - please feel free to contact me here for more POC details. Regards dvl