# Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy

Shopify App Proxy backend could return X-Accel-Redirect, letting NGINX internally redirect to arbitrary internal locations; no internal route actually reached.

- Payout: $500
- Severity: none
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2021-02-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1027873
- Library page: https://bugbountylibrary.com/r/h1%3A1027873
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone tech:nginx technique:recon vuln:misconfiguration

**Target:** *.myshopify.com App Proxy / NGINX reverse proxy
**Root cause:** Shopify's NGINX does not set proxy_ignore_headers X-Accel-Redirect, so an attacker-controlled App Proxy backend can dictate an internal redirect target via the response header.
**Steps:**
1. Create a mock server returning header `X-Accel-Redirect: /collections/all` (e.g. mocky.io).
2. In Shopify Partners create a private app, install on shop, configure App Proxy: prefix `a`, subpath `apps`, Proxy URL = mock URL.
3. Request `https://{shop}.myshopify.com/a/apps`.
4. Observe the response is the shop's `/collections/all` page, proving NGINX followed the attacker-supplied X-Accel-Redirect.
5. Fuzz internal location paths via the header to attempt reaching `internal` NGINX locations.
**How found:** Researcher knew NGINX X-Accel-Redirect lets an upstream dictate internal redirects, and that App Proxy makes the attacker's backend an upstream to Shopify's NGINX; tested by pointing the proxy at a mock returning the header and confirming the shop page was served.
**Exploitation:** Attacker controls the upstream App Proxy response and sets X-Accel-Redirect to an arbitrary path; NGINX performs an internal redirect and serves that location's content to the attacker. No internal route was successfully reached in testing.
**Insight:** When a platform proxies to user-controlled backends, test response headers like X-Accel-Redirect and X-Sendfile: if the front proxy honors them, you control internal redirects without needing a URL-parsing bug.