# Reverse Proxy misroute leading to steal X-Shopify-Access-Token header

Shopify admin GraphQL endpoint lacked Host header validation, proxying requests to attacker-controlled hosts and leaking the X-Shopify-Access-Token header.

- Payout: $1,000
- Severity: medium
- Program: Shopify
- Credited: chaosbolt
- Disclosed: 2019-03-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/429617
- Library page: https://bugbountylibrary.com/r/h1%3A429617
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:graphql technique:recon vuln:host-header vuln:info-disclosure vuln:ssrf

**Target:** /admin/api/graphql reverse proxy endpoint
**Root cause:** The reverse proxy in front of /admin/api/graphql used the client-supplied Host header to build the upstream URL without validating it against allowed hosts, so requests were forwarded to arbitrary hosts.
**Steps:**
1. Send `POST /admin/api/graphql` with `Host: attacker.example` header
2. Attacker-controlled host receives the proxied request including reverse-proxy headers such as `X-Shopify-Access-Token`
3. Observe the response body returned from the attacker host relayed back to the client
**How found:** Noticed the endpoint appeared to fetch content based on the Host header value; tested by pointing Host at an external server and observing incoming requests from Shopify's Google Cloud cluster carrying proxy headers.
**Exploitation:** Attacker sets Host header to their own server; Shopify's proxy fetches ${HTTP_Host}/admin/api/graphql, forwarding internal proxy headers including the victim's X-Shopify-Access-Token to the attacker, who captures it from incoming request logs.
**Insight:** When testing admin/API endpoints behind reverse proxies, swap the Host header to a collaborator and inspect incoming headers — proxies often forward auth tokens and internal headers to the attacker-controlled origin.