# Reflected XSS in *.myshopify.com/account/register

Shopify's customer registration form reflected HTML first/last name unescaped in error messages, enabling reflected XSS via a CSRF-less POST to /account/register.

- Payout: $1,500
- Severity: medium
- Program: Shopify
- Found by: ishahriyar
- Disclosed: 2019-03-12
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/470206
- Library page: https://bugbountylibrary.com/r/h1%3A470206
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:csrf vuln:xss

**Target:** *.myshopify.com/account/register customer registration form
**Root cause:** When registration failed (e.g. short password), the submitted first/last name containing HTML was reflected unescaped into the error page. The form lacked CSRF protection, so a cross-site POST could trigger the reflection.
**Steps:**
1. Enable customer registration on a shop.
2. Submit registration with a short password and HTML payload in first/last name.
3. Server redirects to /account/register rendering the error with the unescaped name value.
4. Because no CSRF token is required, an attacker page can auto-POST the same payload to force execution.
**How found:** Noticed the default registration form returned an error when first/last name contained HTML, and the value was reflected unescaped; observed no CSRF protection on the form, making the POST-triggered reflection exploitable cross-site.
**Exploitation:** Attacker hosts a page that auto-submits a POST to the victim shop's /account/register with a short password and HTML/JS payload in the name fields; the resulting error page reflects the payload unescaped, executing script in the shop origin. If an authenticated staff user visits, this grants access to /admin, partially mitigated by captcha.
**Escalation:** Targeting authenticated staff users to pivot into /admin.
**Insight:** POST-only reflections still matter when the endpoint lacks CSRF protection — an attacker page can auto-submit the form; check error/validation reflection paths, not just success responses.