# H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption

Unauthenticated GraphQL endpoint on beerify.shopifycloud.com exposed internal office beer inventory and employee contact info via introspection and location queries.

- Payout: $802
- Severity: none
- Program: Shopify
- Credited: emitrani
- Disclosed: 2019-05-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/419883
- Library page: https://bugbountylibrary.com/r/h1%3A419883
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone tech:graphql technique:fuzzing technique:recon vuln:access-control vuln:info-disclosure

**Target:** GraphQL endpoint /graphql on *.shopifycloud.com subdomains
**Root cause:** GraphQL endpoint deployed without authentication, exposing introspection and internal data queries (allLocations, location.taps) to anonymous users.
**Steps:**
1. Enumerate subdomains of *.shopifycloud.com
2. Fuzz `/graphql` on each with `wfuzz`, filter 200 responses (~10 hits)
3. Send introspection query with `Content-type: application/json` header to download schemas
4. POST `{"query": "query allLocations{allLocations{address, code, contact}}"}` to beerify.shopifycloud.com/graphql
5. Use returned `code` in `{"query": "query location{location(code:\"OTT150, 8th Floor\"){taps{edges{node{percentRemaining, beer{brewery, ibu, style, tastingNotes, beerLogo, abv}}}}}}"}`
**How found:** Read public report #397130 showing a /graphql endpoint on *.shopifycloud.com behind Okta; hypothesized other subdomains had similar unauthenticated GraphQL endpoints. Enumerated subdomains, fuzzed /graphql with wfuzz filtering 200s, then ran introspection (initially failed with 'query string not present' until adding Content-type header).
**Exploitation:** Unauthenticated attacker queries the GraphQL endpoint directly; no auth bypass needed. Introspection reveals schema, then allLocations leaks employee name and location code, which is used as argument to pivot into beer tap inventory data.
**Insight:** When a public report shows one subdomain exposing an unauthenticated GraphQL endpoint, enumerate sibling subdomains and fuzz the same path — internal tooling subdomains often skip auth. Missing Content-type: application/json causes GraphQL servers to reject introspection with misleading errors.