# Stealing livechat token and using it to chat as the user - user information disclosure

Shopify livechat OAuth redirect_uri accepted any *.myshopify.com host, letting an attacker shop capture the auth_code and impersonate the victim in support chat.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2016-07-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/151058
- Library page: https://bugbountylibrary.com/r/h1%3A151058
- Tags: area:web domain:web impact:ato impact:pii-leak kind:bounty platform:hackerone sev:high tech:oauth technique:recon vuln:account-takeover vuln:auth-bypass vuln:open-redirect

**Target:** OAuth auth endpoint (tasker-merchant-auth.herokuapp.com) and livechat.shopify.com
**Root cause:** The OAuth redirect_uri (return_to) was validated only as a wildcard *.shopify.com / *.myshopify.com, so any attacker-controlled shop host could receive the auth_code.
**Steps:**
1. Visit `https://tasker-merchant-auth.herokuapp.com/auth/shopify/?utf8=%E2%9C%93&auth_type=chat&return_to=https://<attacker_shop>.myshopify.com/&shop=<victim_shop>.myshopify.com`
2. Victim authorizes (or is auto-redirected) to `https://<attacker_shop>.myshopify.com/?auth_code=<access_token>&auth_type=chat`
3. Attacker JS reads `auth_code` from `window.location.search` and exfiltrates it
4. Open `https://livechat.shopify.com/customer/chats/new?auth_code=<access_token>&auth_type=chat` to log in as the victim
5. View page source and read `TC.CustomerChat` for name, email, chat token
**How found:** Noticed the return_to parameter accepted any *.shopify.com / *.myshopify.com host, then realized an attacker-controlled shop could receive the OAuth code.
**Exploitation:** Attacker registers a shop, hosts JS on it, sends the crafted auth link to a victim; the victim's auth_code lands on the attacker shop, which captures it and replays it against livechat.shopify.com to impersonate the victim in support chat and read their PII.
**Insight:** When an OAuth redirect allowlist uses wildcard subdomains, check whether any subdomain is user-registrable (e.g. *.myshopify.com shops) — that turns the allowlist into an open redirect that leaks the code.