Shopify · Report #982510
Self XSS
Validstatus
$500bounty
55upvotes
17 Sept 2020disclosed
How it was found
I have found self xss in myshopify.com/admin/apps/import-store/
POC
1 - Go to yourstore.myshopify.com 2 - Go to settings > App -> Import [ maybe ask you for your platform select any one ] 3 - Upload file csv with file name payload xss "><img src=xx onerror=alert(document.domain)>
Impact
XSS Attack