# Shop admin can change external login services

Shop admins could POST to the owner-only login_services endpoint to enable Google Apps OAuth for an arbitrary domain, letting attacker-controlled Google accounts log into the store.

- Payout: $1,000
- Severity: medium
- Program: Shopify
- Credited: satishb3
- Disclosed: 2015-10-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/56626
- Library page: https://bugbountylibrary.com/r/h1%3A56626
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:medium tech:oauth vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Shopify admin login_services Google Apps update endpoint
**Root cause:** The login_services update endpoint lacked an owner-only authorization check, so any full-access shop admin could modify OAuth login configuration despite the UI hiding it.
**Steps:**
1. Log in as a shop admin (full access) to the store admin.
2. Navigate to Settings->Account; observe Login Services section is hidden.
3. Send `POST /admin/login_services/google_apps/update` with valid cookies and authenticity_token and body `utf8=✓&_method=patch&authenticity_token=...&shop[google_apps_login_enabled]=0&shop[google_apps_login_enabled]=1&shop[google_apps_domain]=securitylearn.net&commit=Save`.
4. Log in as Account owner and confirm Google Apps enabled with domain securitylearn.net.
**How found:** Noticed the Login Services UI was hidden from shop admins and hypothesized the backend endpoint lacked the same restriction, then replayed the update request directly.
**Exploitation:** A logged-in shop admin sends the crafted POST to enable Google Apps login for an attacker-controlled domain; anyone with a Google account in that domain can then authenticate to the store via OAuth.
**Escalation:** Enabling a custom Google Apps domain lets the attacker's own Google accounts log into the store, effectively granting persistent access beyond the admin's own account.
**Insight:** When a UI section is hidden by role, replay the underlying update request as the lower-privileged role; hidden UI is not an authorization boundary.