地图 / Bypass of fix #1370749

Bypass of fix #1370749

访问控制 / 访问控制缺陷（通用） / #1489077

厂商: Shopify
严重程度: 低危 · CVSS 3.7
赏金: $900
弱点: 访问控制缺陷（通用）
研究员: @encryptsaan123
披露日期: 2022-04-22
资产: your-store.myshopify.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（6161 字符中的一小部分）

on report #1370749 the reporter found that the preview link is not expiring. So when someone will gain access to the preview link, he can access it for whole life as the preview link remains the same even after changing the storefont password. I have reported the issue #1401525 where i am getting …

原文中的代码

POST /admin/online-store/themes?hmac=████&host=c2hha3RpLWphbjIwMjIubXlzaG9waWZ5LmNvbS9hZG1pbg&locale=en-IN&session=███&shop=shakti-jan2022.myshopify.com&timestamp=1645562098&_signed_params=host%2Clocale%2Csession%2Cshop%2Ctimestamp HTTP/1.1
Host: shakti-jan2022.myshopify.com
Connection: close …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2022-02-22报告提交
2022-04-22公开披露

阅读 HackerOne 原文 ↗作者 @encryptsaan123 · 版权归作者与 Shopify 所有

同类报告

Account Takeover via Password Reset without user interactionsGitLab · 2025-02-26 · $35,000 Exfiltrate and mutate repository and project data through injected templated serviceGitLab · 2019-03-05 · $11,000 Getting all the CD keys of any gameValve · 2018-10-31 · $20,000 Ability to reset password for accountUpserve · 2019-06-06 Publicly accessible Continuous Integration ToolSnapchat · 2021-07-29 One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · 2022-08-02