H1514 Ability to Edit Packaging Slip Templates and View Product & Shipping Information by a low privileged staff in a Sandbox Store #423198 Valid Access Control Low 2019-04-24 $500 8 H1514 Wholesale customer without checkout permission can complete purchases #423546 Valid Access Control Medium 2019-04-10 – 10 H1514 Shopify API ruby SDK session setup lacks input validation, resulting in SSRF and leakage of client secret #423437 Valid Input Validation and Logic None 2019-04-05 – 11 H1514 Lack of access control on edit packing slip template #417839 Valid Access Control Low 2019-04-24 $500 12 Shopify's SF and LA offices Dashboard Information disclosed via Public Gist #729040 Valid Information Disclosure – 2019-11-06 $500 12 H1514 Get access to non public information by pivoting with graphql queries Analysed #423388 Valid Information Disclosure Low 2019-11-03 $1,500 14 Cross Site Scripting at https://app.oberlo.com/ Analysed #542258 Valid Cross-site Scripting Medium 2019-05-26 – 16 DOM XSS via Shopify.API.remoteRedirect Analysed #576532 Valid Cross-site Scripting Low 2019-06-05 – 16 HTML injection in https://interviewing.shopify.com/index.php?candidate= Analysed #601192 Valid Injection and Smuggling Low 2019-07-04 – 17 Clickjacking in [exchangemarketplace.com] Analysed #658217 Valid Misconfiguration and Insecure Design Low 2019-09-18 – 17 Unpublished Product Images can be disclosed Analysed #534554 Valid Access Control Low 2019-06-12 $500 20 H1514 Stored XSS in Return Magic App portal content Analysed #420459 Valid Cross-site Scripting Medium 2019-11-08 – 21 H1514 Stored XSS on Wholesale sales channel allows cross-organization data leakage Analysed #423454 Valid Cross-site Scripting Medium 2019-11-01 – 21 Order Creation Webhooks can be edited/deleted by STAFF with `Settings` only permission Analysed #431633 Valid Access Control Low 2019-05-11 $500 22 STAFF member with NO Explicit permissions can view `ActivityFeed` via GraphQL Analysed #528940 Valid Access Control Low 2019-06-18 $500 23 H1514 Extract information about other sites (new sites) through Affiliate/Referral pages Analysed #423506 Valid Information Disclosure Medium 2019-11-04 – 24 Bypass GraphQL rate limit by abusing negative cost queries Analysed #481518 Valid Input Validation and Logic Low 2019-01-24 – 24 H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link Analysed #422279 Valid Input Validation and Logic Medium 2019-04-10 – 25 Stored - XSS Analysed #532643 Valid Cross-site Scripting Medium 2019-05-28 – 27 Bypass report #416983 - Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #698708 Valid Access Control Medium 2019-10-10 – 28 Stored XSS in https://productreviews.shopifyapps.com/proxy/v4/reviews/product Analysed #168458 Valid Cross-site Scripting – 2019-11-08 – 30 any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store Analysed #629150 Valid Access Control Low 2019-07-15 – 30 [Privilege Escalation] Shopify Admin -- Permission from Settings to Customer Analysed #541606 Valid No weakness recorded Low 2019-07-05 – 33 DOM XSS via Shopify.API.Modal.initialize Analysed #602767 Valid Cross-site Scripting Low 2019-06-21 $500 34 XSS on product comments in transfers Analysed #738072 Valid Cross-site Scripting Low 2019-12-09 $500 35 Removed staff members who had "Manage shops" permission can still create development stores Analysed #254588 Valid Access Control Medium 2019-11-08 – 38 StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts Analysed #708013 Valid Authentication Medium 2019-10-07 – 38 XSS on services.shopify.com Analysed #591786 Valid Cross-site Scripting Low 2019-06-14 $500 43 H1514 Removed Staff members who had "Apps" permission can still modify flow app connections Analysed #416983 Valid Access Control Low 2019-06-14 – 44 H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps Analysed #423218 Valid Cross-site Scripting Medium 2019-11-04 $500 46 H1514 Bypass Wholesale account signup restrictions Analysed #423496 Valid Access Control Medium 2019-06-07 – 48 Reflected XSS Analysed #569241 Valid Cross-site Scripting Low 2019-05-28 – 48 Inject page in admin panel via Shopify.API.pushState Analysed #662083 Valid Cross-site Scripting Low 2019-09-09 $500 51 Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission Analysed #700831 Valid Input Validation and Logic Medium 2019-10-10 – 53 SSRF in hatchful.shopify.com Analysed #409701 Valid Server-Side Request Forgery Low 2019-04-04 $500 56 H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption Analysed #419883 Valid Information Disclosure None 2019-05-08 $802 57 Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance. Analysed #417170 Valid Information Disclosure Low 2019-04-04 $500 62 POST-based XSS on apps.shopify.com Analysed #429679 Valid Cross-site Scripting Low 2019-03-14 $500 69 help.shopify.com Cross Site Scripting Analysed #564196 Valid Cross-site Scripting Low 2019-05-12 – 71 Stored XSS in Discounts section Analysed #618031 Valid Cross-site Scripting Medium 2019-06-27 $1,000 75 Ability to verify any email address you don't own - accounts.shopify.com Analysed #229619 Valid Misconfiguration and Insecure Design – 2019-11-08 – 76 ██████ DOM XSS via Shopify.API.remoteRedirect Analysed #646505 Valid Cross-site Scripting Low 2019-09-15 – 76 Reflective Cross-site Scripting via Newsletter Form Analysed #709336 Valid Cross-site Scripting High 2019-10-11 $2,000 79 Reverse Proxy misroute leading to steal X-Shopify-Access-Token header Analysed #429617 Valid Server-Side Request Forgery Medium 2019-03-14 $1,000 90 Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile) Analysed #637194 Valid Authentication Low 2019-08-14 $500 90 Reflected XSS in *.myshopify.com/account/register Analysed #470206 Valid Cross-site Scripting Medium 2019-03-12 – 104 Stored XSS in Shopify Chat Analysed #756729 Valid Cross-site Scripting Low 2019-12-23 $500 106 Access to Employee calendar disclosing internal presentation and meetings Analysed #489284 Valid Access Control Low 2019-03-08 $1,000 111 Stored XSS in private message #729424 Valid Cross-site Scripting Medium 2019-11-08 $1,000 124 H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.com Analysed #423136 Valid Authentication – 2019-04-25 – 144