{"id": "H1:94899", "hash": "8754e5f0046003f2695549ae9cd618b5", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Shopify: Paid account can review\\download any invoice of any other shop", "description": "Hi Shopify Team\nI would like to report serious security issue within admin panel of Paid Myshopify account\nPaid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it.\nIn web variant of invoice, financial details revealed.\n**In PDF variant - address of web shop, owner's email and all billing information [name\\address\\money amount etc] disclosed **\n\nPOC:\n1. Authenticate in Paid [not Developer] Shop as Shop Owner \n2. Go to invoices and alter url by changing invoice number at the end of URL: \n\n hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632\n\n 3. To download PDF and review other paid user's data, use link:\n\n hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf\n\nPlease note, that due to limitation of Developer's account, this test cannot be performed on Dev store. \nI also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy.\nIf anyway more details needed - please feel free to contact me here for more POC details.\nRegards\ndvl", "published": "2015-10-20T20:15:09", "modified": "2015-10-22T20:44:39", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/94899", "reporter": "dvl", "references": [], "cvelist": [], "lastseen": "2018-07-30T14:12:04", "history": [{"bulletin": {"id": "H1:94899", "hash": "ccb15221a28c285a09e1d73d46257e92e082a23cfd3b67089aa1d2bc144eadcd", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Shopify: Paid account can review\\download any invoice of any other shop", "description": "Hi Shopify Team\nI would like to report serious security issue within admin panel of Paid Myshopify account\nPaid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it.\nIn web variant of invoice, financial details revealed.\n**In PDF variant - address of web shop, owner's email and all billing information [name\\address\\money amount etc] disclosed **\n\nPOC:\n1. Authenticate in Paid [not Developer] Shop as Shop Owner \n2. Go to invoices and alter url by changing invoice number at the end of URL: \n\n hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632\n\n 3. To download PDF and review other paid user's data, use link:\n\n hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf\n\nPlease note, that due to limitation of Developer's account, this test cannot be performed on Dev store. \nI also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy.\nIf anyway more details needed - please feel free to contact me here for more POC details.\nRegards\ndvl", "published": "2015-10-20T20:15:09", "modified": "1970-01-01T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/94899", "reporter": "dvl", "references": [], "cvelist": [], "lastseen": "2017-08-22T11:09:39", "history": [], "viewCount": 2, "enchantments": {}, "objectVersion": "1.4", "bounty": 4000.0, "bountyState": "resolved", "h1team": {"handle": "shopify", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/001/382/1615f555e8797f39e4e18d266aea7d2b349b3d26_medium.jpg?1433953347", "small": "https://profile-photos.hackerone-user-content.com/production/000/001/382/89bcc3cd934e546d85bc5dbe0ab1b6b4d9fe7566_small.jpg?1433953347"}, "url": "https://hackerone.com/shopify"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/018/725/3242bf7d1ea45a7f9ad2f0f42af8feb746e8f4bb_small.jpg?1426071754"}, "url": "/dvl", "username": "dvl"}}, "differentElements": ["h1reporter"], "edition": 1, "lastseen": "2017-08-22T11:09:39"}, {"bulletin": {"id": "H1:94899", "hash": "c8d5b6bc4ec0dde475d14c47ed506ceeec0b45e47572f6de8f232fb94f1e87b8", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Shopify: Paid account can review\\download any invoice of any other shop", "description": "Hi Shopify Team\nI would like to report serious security issue within admin panel of Paid Myshopify account\nPaid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it.\nIn web variant of invoice, financial details revealed.\n**In PDF variant - address of web shop, owner's email and all billing information [name\\address\\money amount etc] disclosed **\n\nPOC:\n1. Authenticate in Paid [not Developer] Shop as Shop Owner \n2. Go to invoices and alter url by changing invoice number at the end of URL: \n\n hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632\n\n 3. To download PDF and review other paid user's data, use link:\n\n hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf\n\nPlease note, that due to limitation of Developer's account, this test cannot be performed on Dev store. \nI also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy.\nIf anyway more details needed - please feel free to contact me here for more POC details.\nRegards\ndvl", "published": "2015-10-20T20:15:09", "modified": "2015-10-22T20:44:39", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/94899", "reporter": "dvl", "references": [], "cvelist": [], "lastseen": "2017-08-29T13:11:22", "history": [], "viewCount": 2, "enchantments": {"score": {"modified": "2017-08-29T13:11:22", "value": 9.0}}, "objectVersion": "1.4", "bounty": 4000.0, "bountyState": "resolved", "h1team": {"handle": "shopify", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/001/382/1615f555e8797f39e4e18d266aea7d2b349b3d26_medium.jpg?1433953347", "small": "https://profile-photos.hackerone-user-content.com/production/000/001/382/89bcc3cd934e546d85bc5dbe0ab1b6b4d9fe7566_small.jpg?1433953347"}, "url": "https://hackerone.com/shopify"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/018/725/3242bf7d1ea45a7f9ad2f0f42af8feb746e8f4bb_small.jpg?1426071754"}, "url": "/dvl", "username": "dvl"}}, "differentElements": ["h1reporter"], "edition": 3, "lastseen": "2017-08-29T13:11:22"}, {"bulletin": {"id": "H1:94899", "hash": "d317a0fa572ed15cdb0648e4a9670e9fe32bbcc48ca4cdb132baa0b9dc11cde5", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Shopify: Paid account can review\\download any invoice of any other shop", "description": "Hi Shopify Team\nI would like to report serious security issue within admin panel of Paid Myshopify account\nPaid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it.\nIn web variant of invoice, financial details revealed.\n**In PDF variant - address of web shop, owner's email and all billing information [name\\address\\money amount etc] disclosed **\n\nPOC:\n1. Authenticate in Paid [not Developer] Shop as Shop Owner \n2. Go to invoices and alter url by changing invoice number at the end of URL: \n\n hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632\n\n 3. To download PDF and review other paid user's data, use link:\n\n hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf\n\nPlease note, that due to limitation of Developer's account, this test cannot be performed on Dev store. \nI also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy.\nIf anyway more details needed - please feel free to contact me here for more POC details.\nRegards\ndvl", "published": "2015-10-20T20:15:09", "modified": "2015-10-22T20:44:39", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/94899", "reporter": "dvl", "references": [], "cvelist": [], "lastseen": "2018-04-19T17:34:13", "history": [], "viewCount": 2, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "objectVersion": "1.4", "bounty": 4000.0, "bountyState": "resolved", "h1team": {"handle": "shopify", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/000/001/382/1615f555e8797f39e4e18d266aea7d2b349b3d26_medium.jpg?1433953347", "small": "https://profile-photos.hackerone-user-content.com/000/001/382/89bcc3cd934e546d85bc5dbe0ab1b6b4d9fe7566_small.jpg?1433953347"}, "url": "https://hackerone.com/shopify"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "hackerone_triager": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/000/018/725/3242bf7d1ea45a7f9ad2f0f42af8feb746e8f4bb_small.jpg?1426071754"}, "url": "/dvl", "username": "dvl"}}, "differentElements": ["h1team"], "edition": 5, "lastseen": "2018-04-19T17:34:13"}, {"bulletin": {"id": "H1:94899", "hash": "03b11f039ae1867e0b5a60fa615a4d459ebb080cf14c86cdf3e84f4719833f71", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Shopify: Paid account can review\\download any invoice of any other shop", "description": "Hi Shopify Team\nI would like to report serious security issue within admin panel of Paid Myshopify account\nPaid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it.\nIn web variant of invoice, financial details revealed.\n**In PDF variant - address of web shop, owner's email and all billing information [name\\address\\money amount etc] disclosed **\n\nPOC:\n1. Authenticate in Paid [not Developer] Shop as Shop Owner \n2. Go to invoices and alter url by changing invoice number at the end of URL: \n\n hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632\n\n 3. To download PDF and review other paid user's data, use link:\n\n hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf\n\nPlease note, that due to limitation of Developer's account, this test cannot be performed on Dev store. \nI also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy.\nIf anyway more details needed - please feel free to contact me here for more POC details.\nRegards\ndvl", "published": "2015-10-20T20:15:09", "modified": "2015-10-22T20:44:39", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/94899", "reporter": "dvl", "references": [], "cvelist": [], "lastseen": "2018-02-07T16:57:59", "history": [], "viewCount": 2, "enchantments": {"score": {"modified": "2018-02-07T16:57:59", "value": 3.3, "vector": "AV:N/AC:L/Au:M/C:N/I:N/A:P/"}}, "objectVersion": "1.4", "bounty": 4000.0, "bountyState": "resolved", "h1team": {"handle": "shopify", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/001/382/1615f555e8797f39e4e18d266aea7d2b349b3d26_medium.jpg?1433953347", "small": "https://profile-photos.hackerone-user-content.com/production/000/001/382/89bcc3cd934e546d85bc5dbe0ab1b6b4d9fe7566_small.jpg?1433953347"}, "url": "https://hackerone.com/shopify"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "hackerone_triager": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/018/725/3242bf7d1ea45a7f9ad2f0f42af8feb746e8f4bb_small.jpg?1426071754"}, "url": "/dvl", "username": "dvl"}}, "differentElements": ["h1team", "h1reporter"], "edition": 4, "lastseen": "2018-02-07T16:57:59"}, {"bulletin": {"id": "H1:94899", "hash": "9987ae91c20c9635674d0250cbc4c519ce80ce02fd54a8f555f86766856b12bb", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Shopify: Paid account can review\\download any invoice of any other shop", "description": "Hi Shopify Team\nI would like to report serious security issue within admin panel of Paid Myshopify account\nPaid Customer [after been detached from Development account and valid payment detailes entered] able to review any other invoice, issues to any other client, and download it.\nIn web variant of invoice, financial details revealed.\n**In PDF variant - address of web shop, owner's email and all billing information [name\\address\\money amount etc] disclosed **\n\nPOC:\n1. Authenticate in Paid [not Developer] Shop as Shop Owner \n2. Go to invoices and alter url by changing invoice number at the end of URL: \n\n hxx0s://myshop.myshopify.com/admin/settings/account/invoice/1746632\n\n 3. To download PDF and review other paid user's data, use link:\n\n hxx0s://myshop.myshopify.com/admin/invoices/1746632.pdf\n\nPlease note, that due to limitation of Developer's account, this test cannot be performed on Dev store. \nI also prefer do not attach any screenshots or files, since it will be violation of valid customer's privacy.\nIf anyway more details needed - please feel free to contact me here for more POC details.\nRegards\ndvl", "published": "2015-10-20T20:15:09", "modified": "1970-01-01T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/94899", "reporter": "dvl", "references": [], "cvelist": [], "lastseen": "2017-08-28T23:19:24", "history": [], "viewCount": 2, "enchantments": {}, "objectVersion": "1.4", "bounty": 4000.0, "bountyState": "resolved", "h1team": {"handle": "shopify", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/001/382/1615f555e8797f39e4e18d266aea7d2b349b3d26_medium.jpg?1433953347", "small": "https://profile-photos.hackerone-user-content.com/production/000/001/382/89bcc3cd934e546d85bc5dbe0ab1b6b4d9fe7566_small.jpg?1433953347"}, "url": "https://hackerone.com/shopify"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/018/725/3242bf7d1ea45a7f9ad2f0f42af8feb746e8f4bb_small.jpg?1426071754"}, "url": "/dvl", "username": "dvl"}}, "differentElements": ["modified"], "edition": 2, "lastseen": "2017-08-28T23:19:24"}], "viewCount": 2, "enchantments": {"score": {"value": 0.4, "vector": "NONE", "modified": "2018-07-30T14:12:04"}, "dependencies": {"references": [], "modified": "2018-07-30T14:12:04"}, "vulnersScore": 0.4}, "objectVersion": "1.4", "bounty": 4000.0, "bountyState": "resolved", "h1team": {"handle": "shopify", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/000/001/382/30421c25f4a7b03ec3250e36efb64f7291402806_medium.jpg?1532728703", "small": "https://profile-photos.hackerone-user-content.com/000/001/382/1e9872bf9cfe04008c2673e07bfecaa83858cca1_small.jpg?1532728703"}, "url": "https://hackerone.com/shopify"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "hackerone_triager": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/000/018/725/3242bf7d1ea45a7f9ad2f0f42af8feb746e8f4bb_small.jpg?1426071754"}, "url": "/dvl", "username": "dvl"}, "_object_type": "robots.models.hackerone.HackerOneBulletin", "_object_types": ["robots.models.hackerone.HackerOneBulletin", "robots.models.base.Bulletin"]}

{}