# H1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.com

Shopify Flow, Transporter and Launchpad kept the same session ID after OAuth login, letting an attacker fix a victim's session cookie via by-design XSS and hijack their account.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: filedescriptor
- Disclosed: 2019-04-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/423136
- Library page: https://bugbountylibrary.com/r/h1%3A423136
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:account-takeover vuln:auth-bypass vuln:xss

**Target:** Shopify-built apps on *.shopifycloud.com / *.shopifyapps.com (Flow, Transporter, Launchpad)
**Root cause:** Apps using session-id cookies did not regenerate the session ID during the OAuth2 /auth/callback login step, so the pre-login session ID became authenticated.
**Steps:**
1. Attacker visits Shopify Flow and copies the generated `_flow_session` session id.
2. Attacker uses by-design XSS on *.shopifycloud.com to write `document.cookie='_flow_session=EVIL;domain=.shopifycloud.com;path=/';` into the victim's browser.
3. Attacker forces the victim to log into Shopify Flow (e.g. via /admin/apps/flow redirect chain).
4. Victim logs in; session id is unchanged, so attacker reuses the fixed session id to authenticate as the victim.
**How found:** After finding XSS in the embedded SDK, the researcher explored what it could be used for, compared apps using signed sessions vs session IDs, and noticed some session-ID apps did not rotate the ID after login.
**Exploitation:** Attacker plants their own `_flow_session` cookie scoped to `.shopifycloud.com` via XSS, waits for the victim to complete OAuth login, then loads `https://flow.shopifycloud.com/?shop=VICTIM_STORE.myshopify.com` (in an iframe) with the fixed session to read victim data.
**Escalation:** Chained a by-design XSS on *.shopifycloud.com (out of scope) with the session fixation to achieve account takeover across multiple Shopify apps.
**Insight:** When XSS is explicitly out of scope on a shared parent domain, look for sibling apps that accept session cookies scoped to that parent and fail to rotate session IDs at OAuth callback — the out-of-scope XSS becomes a cookie-planting primitive for in-scope session fixation.