# Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content

Shopify Android app sent API responses via unprotected implicit broadcast, letting any installed app harvest admin_cookie and access_token to hijack accounts.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: sukhoi
- Disclosed: 2015-07-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/56002
- Library page: https://bugbountylibrary.com/r/h1%3A56002
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:android technique:source-review vuln:info-disclosure

**Target:** Android app implicit broadcast receiver (com.shopify.service.requestComplete)
**Root cause:** NetworkService broadcasts full API responses (headers, body, cookies, tokens) via an implicit broadcast with no permission protection, so any app can register a receiver for it.
**Steps:**
1. Install PoC APK that registers a BroadcastReceiver for action `com.shopify.service.requestComplete` and runs in background.
2. Install and open Shopify client, log in.
3. PoC receiver silently captures admin_cookie and access_token from the broadcast.
4. Print captured values via `adb logcat -s SHOPIFYHACK:V` to confirm; attacker could exfiltrate to a remote server.
5. Continue using app to capture further response data.
**How found:** Noticed the app uses implicit broadcasts (action com.shopify.service.requestComplete) for intra-app network response delivery, sent from NetworkService and received in BaseRequestDelegate, and reasoned that without a permission any app could subscribe.
**Exploitation:** Malicious app registers a receiver for the unprotected implicit broadcast, passively collects every API response including admin_cookie and access_token, then exfiltrates them to take full control of the victim's account. No permissions, root, or user interaction required.
**Insight:** On Android, grep for implicit broadcast actions carrying sensitive data (sendBroadcast without a permission arg); any app can register a receiver for the same action and passively siphon tokens/cookies without root or permissions.