地图 / Ability to bypass partner email confirmation to take over any store given an employee email

Ability to bypass partner email confirmation to take over any store given an employee email

业务逻辑 / TOCTOU 竞态条件 / #300305

厂商: Shopify
严重程度: 高危 · CVSS 10
赏金: $15,250
弱点: TOCTOU 竞态条件
研究员: @cache-money
披露日期: 2018-02-07
资产: partners.shopify.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（2505 字符中的一小部分）

I told Pete I would take a look at Spotify, hi Pete.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2017-12-24报告提交
2018-02-07公开披露

阅读 HackerOne 原文 ↗作者 @cache-money · 版权归作者与 Shopify 所有

同类报告

Race Condition leads to undeletable group memberHackerOne · 2020-03-20 Race condition in activating email resulting in infinite amount of diamonds receivedInnoGames · — · $2,000 Race condition in joining CTF groupHackerOne · 2023-01-08 · $500 [pandao.ru] Возможность списания несуществующих бонусных балловMail.ru · —Promotion code can be used more than redemption limit.Stripe · 2023-02-13 Race condition in claiming program credentialsHackerOne · 2019-05-19