# H1514 CSRF in Domain transfer allows adding your domain to other user's account

CSRF on Shopify's inter-shop domain transfer endpoint let an attacker push their own domain and DNS records into a victim store by knowing its myshopify handle.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: rijalrojan
- Disclosed: 2020-03-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/416978
- Library page: https://bugbountylibrary.com/r/h1%3A416978
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:chained vuln:csrf

**Target:** Shopify admin domain transfer endpoint (settings/domains/initiate_inter_shop_domain_transfer)
**Root cause:** The inter-shop domain transfer endpoint accepted a GET request with a transfer_code and performed the transfer without CSRF token validation, so a cross-site image load triggered it in the victim's authenticated session.
**Steps:**
1. Buy a domain through Shopify and request an inter-store transfer to obtain the emailed link `https://www.shopify.com/login?redirect=settings/domains/initiate_inter_shop_domain_transfer?transfer_code=<uuid>`.
2. Rewrite the link to the victim store host: `https://victimstore.myshopify.com/admin/settings/domains/initiate_inter_shop_domain_transfer?transfer_code=<uuid>`.
3. Embed it as `<img src=...>` in an HTML file.
4. Log into the victim store in a fresh incognito session and open the HTML; the domain transfers to the victim store along with DNS records.
**How found:** Noticed the emailed transfer link used a login redirect to settings/domains/initiate_inter_shop_domain_transfer, hypothesized the endpoint was a state-changing GET, and swapped the host to the victim's myshopify domain to test cross-site triggering.
**Exploitation:** Attacker pre-configures MX, A, NS records, email forwarders and custom subdomains on their own domain, then lures a logged-in victim store admin to a page containing the img tag; the GET fires the transfer, moving the domain and all DNS data into the victim's store.
**Escalation:** Author noted intent to escalate toward stealing store info and payment details via the transferred DNS/email records.
**Insight:** State-changing admin actions hidden behind a login-redirect URL are worth replaying directly against the tenant host as a bare GET; email-link flows often skip CSRF tokens because they assume the link itself is the auth.