# Bypass Filter and get Stored Xss 

SVG navigation icon with XML entity bypassed Shopify's element/attribute whitelist, enabling stored XSS on partners.shopify.com and admin panels of shops using the sales channel.

- Payout: $3,000
- Severity: high
- Program: Shopify
- Credited: dr_dragon
- Disclosed: 2018-12-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/299424
- Library page: https://bugbountylibrary.com/r/h1%3A299424
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high technique:parser-differential vuln:file-upload vuln:xss

**Target:** SVG navigation icon upload in Partners dashboard sales channel app
**Root cause:** The SVG sanitizer whitelist is not enforced when the SVG contains an XML entity, so malicious attributes/script elements pass through unsanitized.
**Steps:**
1. Create a new app in the Shopify Partners dashboard
2. Navigate to Extensions -> Sales channel to convert the app
3. Save changes, then open App info -> Navigation icon
4. Upload SVG: `<svg><!--?php "--><script>confirm(20)</script>?&gt;</svg>`
5. View the icon on partners.shopify.com or a shop admin panel that authorized the sales channel to trigger the script
**How found:** Researcher noticed the SVG design-guideline whitelist restricts elements/attributes, then tested whether an XML entity in the SVG would cause the whitelist to be skipped, and confirmed script execution.
**Exploitation:** Attacker (a developer) uploads a crafted SVG as the sales channel navigation icon; the stored payload executes in the browser of any partner or shop admin who views the icon, allowing session/cookie theft and page rewriting.
**Escalation:** Payload executes on both partners.shopify.com and the admin panel of any shop that authorized the sales channel, widening victim scope.
**Insight:** When a sanitizer enforces an allowlist, try injecting XML entities or malformed markup that may cause the parser to bail out of the validation path while still rendering in the browser.