Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Takeover an account that doesn't have a Shopify ID and more | A user account | Another user's | A verified-email account merge claimed a victim's account without verifying the victim's address. |
| Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO | A user account | Another user's | A trial-store user verified another owner's email and gained control of stores linked through SSO. |
| Github access token exposure | No account | Another tenant's | A public app exposed a token that granted access to an organization's private repositories. |
| [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation | A user account | Another user's | An account-email verification flow accepted an address the attacker did not control, potentially enabling access to another user's account. |
| WannaCrypt “Killswitch” | No account | No object involved | A researcher controlled the domain the malware used for its execution check, preventing new infections from proceeding. |
| Subdomain Takeover to Authentication bypass | No account | No object involved | An unclaimed third-party hosting resource enabled control of content on a trusted company subdomain. |
| CRLF injection | No account | No object involved | Untrusted query input crossed into the HTTP response-header context. |
| June 2022 Incident Report | A privileged role | Another user's | An employee used internal access to customer reports, then disclosed their contents outside the platform for bounty gain. |
| DOM XSS on duckduckgo.com search | No account | No object involved | Untrusted search input crossed into executable browser content. |
| An attacker can archive and unarchive any structured scope object on HackerOne | A user account | Another user's | An authenticated user's mutation changed a structured scope owned by another program. |
| Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation | A user account | Another user's | A controlled store account changed the password for a separate merchant account without its master password. |
| Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}` | No account | Another user's | Unauthenticated access crossed the private-program visibility boundary to retrieve asset-group data. |