# Bypassing HTML filter in "Packing Slip Template" Lead to SSRF to Internal Kubernetes Endpoints

HTML sanitizer in Shopify's packing slip template was bypassed with an SVG/style prefix, letting an iframe SSRF internal Kubernetes HTTPS endpoints.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: cthulhufhtagn
- Disclosed: 2021-12-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1115139
- Library page: https://bugbountylibrary.com/r/h1%3A1115139
- Tags: area:web3 domain:web impact:internal-access kind:bounty platform:hackerone sev:low tech:kubernetes technique:parser-differential technique:source-review vuln:misconfiguration vuln:ssrf

**Target:** Packing slip template PDF generator (admin settings)
**Root cause:** The PDF generator's HTML sanitizer filtered `<iframe>` tags but could be confused by a malformed `<svg><style><h1/>` prefix, allowing the iframe through to the rendered PDF.
**Steps:**
1. Log in and open `https://mystore.myshopify.com/admin/settings/packing_slip_template`
2. Insert `<svg><style><h1/><iframe src="https://kubernetes.default.svc/info" width=1001 height=1001>`
3. Preview template to generate the PDF
4. Observe iframe loads internal Kubernetes endpoint content
5. Repeat with `https://kubernetes.default.svc/livez?verbose`
**How found:** Started by testing whether a plain `<iframe>` survived the packing slip sanitizer; it was filtered, so they prepended a malformed `<svg><style><h1/>` sequence to confuse the parser and found the iframe rendered. Noted only HTTPS was accepted, ruling out GCP metadata but enabling Kubernetes API access.
**Exploitation:** Attacker with template edit access injects a sanitizer-bypassing iframe pointing at internal HTTPS services; the PDF renderer fetches the URL server-side and embeds the response, disclosing internal Kubernetes API output.
**Insight:** When a sanitizer blocks a tag, try prepending malformed foreign-content elements like `<svg><style><h1/>` to desync the parser from the filter; also check whether the renderer restricts schemes—HTTPS-only still reaches internal Kubernetes API endpoints.