# XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app

Malicious Shopify app passes javascript: href in Embedded App SDK button objects, executing JS in admin context via window.open opener when admin clicks.

- Payout: $800
- Severity: high
- Program: Shopify
- Credited: bored-engineer
- Disclosed: 2017-05-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/217745
- Library page: https://bugbountylibrary.com/r/h1%3A217745
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high tech:nodejs technique:chained technique:js-analysis technique:source-review vuln:xss

**Target:** Embedded App SDK button objects in /admin/apps
**Root cause:** Button object href not sanitized; clickButton calls Page.open (window.open) with attacker-controlled javascript: URL, and the opened about:blank window shares document.domain with opener, allowing eval in admin context.
**Steps:**
1. Authorize malicious app via `/admin/oauth/authorize?client_id=...&scope=read_products&redirect_uri=...`
2. App posts `Shopify.API.Bar.initialize` message with `buttons.primary.href` set to `javascript:setTimeout('window.close()',1);window.opener.eval('alert(document.domain)');`
3. Admin clicks the button; clickButton calls Page.open(href)
4. window.open opens about:blank sharing document.domain; javascript: payload runs window.opener.eval in admin context
**How found:** Noticed SDK button objects accept href and traced clickButton to Page.open/window.open; realized javascript: URLs in window.open inherit opener's document.domain, enabling cross-window eval.
**Exploitation:** Attacker publishes app requiring only read_products scope, tricks admin into installing, then renders a button whose href is a javascript: URL. On click, window.open executes the payload against the opener admin window, achieving XSS in the admin origin.
**Insight:** window.open with javascript: URLs is not a safe sink—the new about:blank window shares document.domain with the opener, so any postMessage-driven button/link href in an embedded SDK is an XSS vector.