地图 / Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!

Removing parts of URL from jQuery request exposes links for download of Paid Digital Assets of the most recent Order placed by anyone on the store!

信息泄露 / Unlabeled / #1044285

厂商: Shopify
严重程度: 低危 · CVSS 4.6
赏金: $2,900
弱点: Unlabeled
研究员: @adarshxs
披露日期: 2021-07-08
资产: Shopify Developed Apps
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（5212 字符中的一小部分）

_Please Note:_ I found this bug on a website made using Shopify

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2020-11-26报告提交
2021-07-08公开披露

阅读 HackerOne 原文 ↗作者 @adarshxs · 版权归作者与 Shopify 所有

同类报告

Github access token exposureShopify · 2021-07-26 · $50,000 Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`HackerOne · 2025-01-21 · $25,000 Informations disclosure - Access to some checkout informationsShopify · 2021-03-13 Disclosure handle private program with external linkHackerOne · 2021-08-24 · $2,500 Cloudflare WAF Bypass - Origin IP ExposureHemi VDP · 2025-03-27 [Zomato Order] Insecure deeplink leads to sensitive information disclosureEternal · 2021-09-23 · $750