Shopify admin authentication bypass using partners.shopify.com Analysed #270981 Valid Access Control Critical 2017-09-28 – 311 XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog" Analysed #231053 Valid Cross-site Scripting – 2017-05-30 $3,000 121 XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications Analysed #232174 Valid Cross-site Scripting High 2017-06-27 $5,000 88 SVG Server Side Request Forgery (SSRF) Analysed #223203 Valid Server-Side Request Forgery Low 2017-09-22 $500 81 Reflected XSS in <any>.myshopify.com through theme preview Analysed #226428 Valid Cross-site Scripting – 2017-05-29 – 69 Shopify GitHub Login and Password exposed all private source code might be available. Analysed #124100 Valid Information Disclosure – 2017-06-08 $1,500 66 apps.shopify.com - CSRF token leakage through Google Analytics Analysed #196458 Valid Cross-Site Request Forgery – 2017-02-07 – 48 Stored XSS in blog comments through Shopify API Analysed #192210 Valid Cross-site Scripting Medium 2017-03-16 – 48 Tinymce 2.4.0 Analysed #262230 Valid Cross-site Scripting Medium 2017-09-26 $2,000 37 Stored XSS in [shop].myshopify.com/admin/orders/[id] Analysed #214044 Valid Cross-site Scripting – 2017-03-28 – 36 Self-XSS in password reset functionality Analysed #286667 Valid Cross-site Scripting Low 2017-11-10 – 35 Stored XSS Deleting Menu Links in the Shopify Admin Analysed #263876 Valid Cross-site Scripting Medium 2017-09-08 – 35 Cross-site scripting in "Contact customer" form Analysed #294505 Valid Cross-site Scripting Low 2017-12-19 – 33 IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop Analysed #243943 Valid Insecure Direct Object Reference Medium 2017-07-19 $500 33 XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious app Analysed #217790 Valid Cross-site Scripting High 2017-06-01 $1,000 31 XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app Analysed #217745 Valid Cross-site Scripting High 2017-05-22 $800 30 CSRF in all API endpoints when authenticated using HTTP Authentication Analysed #195156 Valid Cross-Site Request Forgery – 2017-03-28 – 30 Stealing users' facebook access tokens - kitcrm.com Analysed #211477 Valid Information Disclosure – 2017-03-15 – 26 stored xss in invited team member via email parameter Analysed #267177 Valid Cross-site Scripting Medium 2017-11-03 $500 16 XSS on postal codes Analysed #192140 Valid Cross-site Scripting Medium 2017-01-11 – 15 SQL Exception thrown during product import Analysed #237597 Valid Information Disclosure Medium 2017-07-12 – 14 Stored XSS in *.myshopify.com #241008 Valid Cross-site Scripting Medium 2017-06-27 – 13 Subdomain takeover on s3.shopify.com #207576 Valid Cross-site Scripting – 2017-02-27 $500 13 Authentication Bypass on monitoring server #194832 Valid Authentication Low 2017-01-11 – 12 API Webhooks Fire And Are Unlisted After Permissions Removed #227230 Valid Access Control Low 2017-06-27 – 9 ShopifyAPI is vulnerable to timing attacks. #224096 Valid Cryptography Low 2017-06-23 – 9 Open Redirect in shopify app URL #226408 Valid Open Redirect Low 2017-07-21 – 8 Stored passive XSS at scheduled posts (kitcrm.com) #214581 Valid Cross-site Scripting Medium 2017-03-28 – 7 Redirect in adding advance cash on delivery app #188266 Valid Open Redirect Low 2017-06-27 – 7 Full access at an internal service of Shopify #216389 Valid Information Disclosure – 2017-03-28 – 5 XSS in my.shopify.com in widget #185826 Valid Cross-site Scripting Medium 2017-07-21 $500 5 Setting Arbitrary Cookie at kitcrm.com #213991 Valid No weakness recorded None 2017-08-23 – 2