地图 / Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO

Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO

访问控制 / Unlabeled / #791775

厂商: Shopify
严重程度: 高危
赏金: —
弱点: Unlabeled
研究员: @ngalog
披露日期: 2020-04-01
资产: your-store.myshopify.com
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（2912 字符中的一小部分）

I told Pete I would take a look at Spotify, hi Pete.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2020-02-09报告提交
2020-04-01公开披露

阅读 HackerOne 原文 ↗作者 @ngalog · 版权归作者与 Shopify 所有

同类报告

[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · 2020-04-01 Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointMTN Group · 2025-03-02 [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledgeMail.ru · —Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerGitHub · 2024-09-13 Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijackingSony · —Staff without Manage Themes permissions can update themesShopify · 2024-01-23