HexBrain
Open on HackerOneSign in

Shopify · Report #985150

Privilege Escalation in Point Of Sale Application from POS Manage Staff Role to potentially Store Owner

Validstatus
mediumseverity
10upvotes
19 Nov 2020disclosed

Summary

@francisbeaudoin reported an issue where a malicious staff member on a Point of Sale device was able to add staff members to the Shopify admin of the store.

Though this same result could be obtained by stealing the access token used by POS (known behaviour), in this case the UI itself has a flow that allows a user who would normally only have access to point of sale to access the web administrative interface.

Mitigating factors for this issue included:

  • The user logged into the POS terminal must be the account owner
  • The POS user exploiting this issue must have the Staff Management retail permission
  • A persistent attacker with physical access to the device could achieve a similar result by stealing the access token being used by POS

How it was found

I was playing a bit with the Point Of Sale application and it came to my attention that it is possible to navigate from the Point Of Sale Application up to the Plan & Permission in the admin. I am not sure if this is intentional, but since it leads to potentially take over a shop, I'm reporting it.

Within he Point Of Sale application, a staff with full admin permissions can open the Point Of Sale channel using the embedded Magage POS roles link. By doing so and by using some nested links, it is possible to navigate up to the Plan & Permissions admin view giving him access to some store owner permissions:

  1. Add staff account
  2. Manage staff account
  3. Update login service
  4. Transfer ownership (requires the shop owner password but could be used to bypass the 2FA protection)

Given that, a POS staff with only Manage Role could escalate his privileges up to Full Permissions and potentially even take over the shop if knows the admin password.

Steps to reproduce

  1. Create a Staff with Full Permissions
  2. Create a POS user with only Manage Staff permissions
  3. From the Point Of Sale Application, log-in with the admin user then enter the PIN of the POS User from Step 2
  4. Go to Staff, select the staff with Full Permissions from Step 1 and change its PIN to 1234
  5. Lock the application screen and log back in using the 1234 PIN, giving you Full Permissions access within the Application
  6. Go to Staff, select any staff, edit its POS APP ACCESS and click on Manage POS Roles
  7. From the Roles listing page, open the Full Permissions staff's role and scroll at the bottom down so you can see the Assigned Staff section and click on the Staff
  8. Scroll at the bottom again and click on Manage Shopify admin access, this is opening up the staff page from Plan and Permissions.
  9. At the top of the page, click on breadcrumb navigation Plan and Permissions link bringing you to the https://shop.myshopify.com/admin/settings/account

At this point, as the Point Of Sale application is using the physically authenticated user, you're given access to store owner features as mentioned earlier.

Impact

A staff with Manager Staff Role within the Point Of Sale application can escalate his privilege to a Full Permission staff and could potentially transfer the shop ownership by using the Transfer ownership link within the Plans & Permissions page.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original