# Stored XSS in [shop].myshopify.com/admin/orders/[id]

Attacker-controlled _landing_page cookie stored a javascript: URL rendered as a link in Shopify admin order conversion details, executing XSS against store admins.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2017-03-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/214044
- Library page: https://bugbountylibrary.com/r/h1%3A214044
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:rest technique:incomplete-fix vuln:xss

**Target:** myshopify.com admin order detail page (conversion details link)
**Root cause:** The _landing_page cookie value was persisted as the order's landing page and rendered into an anchor href in admin conversion details without validating the URL scheme, allowing javascript: URIs.
**Steps:**
1. Navigate to `[shop].myshopify.com/`
2. Set `_landing_page` cookie value to `javascript:alert(1)`
3. Add a product to cart and complete checkout
4. Log in as admin and open `[shop].myshopify.com/admin/orders/[id]`
5. Click the 'The first page they visited' link; `alert(1)` executes
**How found:** Noticed the conversion details 'first page visited' link reflected the _landing_page cookie, and that a prior report (#55842) covered the referrer path but not the landing page path.
**Exploitation:** Attacker places a javascript: payload in the _landing_page cookie, completes a checkout so the value is stored on the order, then waits for an admin to view the order's conversion details and click the landing page link, executing script in the admin origin to steal CSRF tokens and add the attacker as admin.
**Escalation:** XSS in admin context enables CSRF token theft and privilege escalation to store takeover by adding attacker as admin.
**Insight:** When a prior XSS report covers one source (referrer), enumerate sibling fields feeding the same sink — here the _landing_page cookie stored on the order — since fixes often patch only the reported vector.