Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata
身份认证 / Missing Authentication for Critical Function / #3954327
该报告还没有中文解读。
原文摘录
摘自原文（3485 字符中的一小部分）
`checkout-blocks.shopifyapps.com` has staff pages at `/internal` and `/api/internal/`. Ask for one without an employee session and you get redirected to `minerva.shopifycloud.com`, your employee login. That redirect is the only thing protecting them.
原文中的代码
1 normal /api/internal/shops -> 302 https://minerva.shopifycloud.com/auth/minerva?... 2 bypass /_next/data/ID/..shops -> 200 628 bytes application/json 3 ghost /_next/data/NOPE/.. -> 404 (expect 404) 4 control /_next/data/ID/..admin -> 302 .../login (expect 302 login) 5 last …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @cafecito · 版权归作者与 Shopify 所有