How it was found

Hello Shopify Security Team!

Bug Summary:

Based on the report #968165, this also can retrieve the STUFF member name and can send messages using his name.

Reproduction steps:

• install shopify chat applications.

Start Exploit #1 :

• Go to targeted store :
• Start a chat using the app with the store support.
• Click on I need an update on my order.
• fill out the Order ID and Email. ( fill the info randomly if you want to), the respond comes with message "in order to provide you with ....".
• I intercept the the post request, and inject changes in the request,
• In this exploit allowed the attacker to send messages like a team member (bot)

{F965084}

Example : i changed text element to " Hello customer hahaha "

Result :

poc from shopify ping application ( STUFF side )

{F965081}

Start Exploit #2 :

• Go to targeted store :
• Start a chat using the app with the store support.
• As soon as you get the answer.
• I intercept the message request, i found the STUFF member name and ID.

{F965077}

{F965078}

Impact

Can retrive STUFF info, not allowed !