# Open redirect using checkout_url

Shopify logout/login return_url accepted checkout.shopify.com, whose store 404 path attacker controlled via URL redirect to reach evil.com.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2016-09-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/159522
- Library page: https://bugbountylibrary.com/r/h1%3A159522
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:chained vuln:open-redirect

**Target:** myshopify.com account logout/login return_url parameter
**Root cause:** The return_url/checkout_url parameter allowed redirects to checkout.shopify.com, which itself honored attacker-configured store URL redirects, so a trusted-domain hop reached an arbitrary external site.
**Steps:**
1. Attacker creates a Shopify store and adds a URL redirect with old path `/[Store_id]` pointing to `evil.com`.
2. Send victim `https://<victim>.myshopify.com/account/logout?return_url=https://checkout.shopify.com/[Attacker's_store_id]`.
3. Victim is redirected to checkout.shopify.com/<id>, which 404s and applies the store redirect to evil.com.
4. Login variant: `https://<account>.myshopify.com/account/login?checkout_url=https://checkout.shopify.com/14372648` redirects to evil.com after login.
**How found:** Noticed return_url accepted checkout.shopify.com and that checkout store 404 pages honor merchant-configured URL redirects, turning a trusted domain into an open redirect pivot.
**Exploitation:** Chain a trusted-domain redirect (checkout.shopify.com) with an attacker-controlled store-level URL redirect so the final hop lands on evil.com, usable for phishing after logout or login.
**Insight:** When a redirect allowlist trusts a subdomain, check whether that subdomain hosts user-controlled redirect config (store URL redirects, custom 404s) that can complete the hop to an external site.