# H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link

Weak server-side URL check on incontext_app_link allowed userinfo with backslashes to bypass shopifycloud.com validation, loading attacker content in an admin modal for phishing.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: fransrosen
- Disclosed: 2019-04-10
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/422279
- Library page: https://bugbountylibrary.com/r/h1%3A422279
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:rest technique:parser-differential vuln:business-logic vuln:misconfiguration vuln:open-redirect

**Target:** Shopify admin products page incontext_app_link parameter
**Root cause:** Server-side validation only checked that the URL contained shopifycloud.com but allowed userinfo before the @; two backslashes in userinfo make browsers (except Safari) treat the text before @ as the host, so an attacker domain loads while the URL still appears to point at shopifycloud.com.
**Steps:**
1. Craft URL: `/admin/products/1557454323768?incontext_app_link=https%3A%2F%2F████████%5C%5C%40google-shopping.shopifycloud.com`
2. Replace product ID with a valid one from the target store
3. Send link to a store admin; API.modal.open fires on page load
4. Modal loads attacker HTML (fake login form) from ██████ while URL shows shopifycloud.com
5. Victim submits credentials to attacker form
**How found:** Noticed server-side check only verified presence of shopifycloud.com and permitted userinfo; hypothesized that backslash userinfo would be parsed as host by browsers, redirecting the modal to an attacker domain while passing validation.
**Exploitation:** Attacker hosts a fake Shopify login page and posts a crafted admin product URL to the victim admin. On load, the modal opens automatically and renders attacker content, styled to look like a reauthorization prompt; submitted credentials are captured by the attacker's form handler.
**Insight:** When a URL allowlist checks for a substring like a trusted domain, test userinfo tricks (`user@host`) and backslash variants (`\\@host`) that browsers normalize differently than the validator; auto-opening modals make these directly weaponizable for phishing.