# Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor

Path traversal in checkout.shopify.com store-id validation bypasses open-redirect fix, letting attacker store's 404 page redirect the admin theme editor iframe to arbitrary domains.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2016-09-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/165046
- Library page: https://bugbountylibrary.com/r/h1%3A165046
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:incomplete-fix vuln:open-redirect vuln:path-traversal

**Target:** checkout.shopify.com return_url validation and admin theme editor iframe
**Root cause:** The fix only allowed return_url to checkout.shopify.com/<exact_store_id>/, but a `/../<attacker_store_id>` path segment normalizes to the attacker's store, which then serves attacker-controlled 404 HTML/JS.
**Steps:**
1. Confirm fix: `victim.myshopify.com/account/logout?return_url=https://checkout.shopify.com/<victim_store_id>/` works, attacker store id does not.
2. Bypass with traversal: `victim.myshopify.com/account/logout?return_url=https://checkout.shopify.com/<victim_store_id>/../14467660` (14467660 = attacker store id).
3. Attacker hosts redirecting HTML/JS on their store's 404 page.
4. Load `https://<your_store>.myshopify.com/admin/themes/<theme_id>/editor#/account/logout?return_url=https://checkout.shopify.com/<your_store_id>/../14467660` to change iframe content.
**How found:** Reviewed the deployed fix's validation logic (exact store id match on checkout.shopify.com path) and hypothesized path normalization could reach a different store id.
**Exploitation:** Attacker crafts a URL whose return_url passes the exact-store-id check via `/../<attacker_store_id>` traversal; checkout.shopify.com redirects to the attacker store, whose 404 page runs attacker JS, redirecting the admin theme editor iframe to any domain.
**Insight:** When a fix whitelists an exact path segment, test `/../` traversal and normalization to reach sibling paths the check didn't anticipate; also look for attacker-controlled pages (404) on the allowed origin.