# XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications

SVG navigation icon with an XML entity bypassed Shopify's element/attribute whitelist, enabling stored XSS on partners.shopify.com and any shop admin panel that authorized the sales channel app.

- Payout: $5,000
- Severity: high
- Program: Shopify
- Credited: bored-engineer
- Disclosed: 2017-06-27
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/232174
- Library page: https://bugbountylibrary.com/r/h1%3A232174
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:parser-differential technique:source-review vuln:xss

**Target:** Sales Channel app SVG navigation icon upload (partners.shopify.com and $shop$.myshopify.com/admin)
**Root cause:** The SVG sanitizer/whitelist is skipped or mis-parsed when the SVG contains an XML entity declaration, so disallowed attributes like onload survive into the rendered icon.
**Steps:**
1. Create an app in the Partners dashboard and convert it to a Sales Channel via Extensions -> Sales channel
2. In App info -> Navigation icon upload an SVG containing `<!DOCTYPE svg [<!ENTITY elem "">]>` and `<svg onload="alert(document.domain);" height="16" width="16">&elem;</svg>`
3. Save changes; payload fires on partners.shopify.com
4. To hit shop admin, authorize the app on a shop via `/admin/oauth/authorize?client_id=...&scope=read_products&redirect_uri=...`
5. Payload fires on every /admin panel load for that shop
**How found:** Noticed the design-guideline whitelist restricts SVG elements/attributes, then hypothesized the parser handling of XML entities might bypass that enforcement and tested an entity-containing SVG.
**Exploitation:** Attacker publishes a sales channel app with a malicious SVG icon; the payload executes in the partners dashboard immediately and in the admin panel of any shop that authorizes the app via the OAuth consent URL, requiring only admin authorization and no specific scopes.
**Insight:** When a sanitizer enforces an allowlist on SVG/XML, test DOCTYPE entity declarations and other parser-level constructs (entities, CDATA, namespaces) that may cause the sanitizer and the renderer to disagree on what elements/attributes exist.