# apps.shopify.com - CSRF token leakage through Google Analytics

Shopify leaked the CSRF authenticity_token in the redirect URL to app pages, where attacker-controlled Google Analytics captured it, enabling forged requests as the victim.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2017-02-07
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/196458
- Library page: https://bugbountylibrary.com/r/h1%3A196458
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:payment vuln:csrf vuln:info-disclosure vuln:secrets-leak

**Target:** apps.shopify.com app listing support/login redirect flow
**Root cause:** The authenticity_token was placed in the URL query string on redirect after login, and app developers could inject arbitrary Google Analytics tracking code into their app page, capturing the full URL including the token.
**Steps:**
1. Create app at `https://app.shopify.com/services/partners/api_clients/new`, click Edit App Listing, set Google analytics code field to attacker's GA code.
2. Visit `https://apps.shopify.com/[your_app_id]/support_interactions/new`, get redirected to login, enter shop domain and log in.
3. After login redirected to `https://apps.shopify.com/img-src-x-onerror-prompt2?reveal_support=true?authenticity_token=[Your_CSRF_TOKEN]&utf8=%E2%9C%93`.
4. Open Google Analytics Real Time dashboard and observe full URL with authenticity_token disclosed.
**How found:** Noticed the authenticity_token appeared in the redirect URL after login, then realized app developers control GA tracking code on their app page, which captures full URLs.
**Exploitation:** Attacker lures victim to an HTML page that opens a window to `https://apps.shopify.com/[attacker's_app]/support_interactions/new`; after victim logs in they are redirected to the attacker's app page with their authenticity_token in the URL, which the attacker's injected GA code records and the attacker reads from Real-Time analytics. Token then used to forge requests to `https://apps.shopify.com/services/shopify_applications/edit` or submit reviews/support messages.
**Escalation:** Token reuse against edit endpoint allows modifying victim's app listing; also reviews and support messages.
**Insight:** When a token lands in a URL, check every third-party script/tracking surface on that page (developer-injected analytics) as an exfil channel; login redirects that append authenticity_token to query strings are prime leak points.