# DOM XSS via Shopify.API.Modal.initialize

DOM XSS in Shopify.API.Modal.initialize via postMessage with javascript: src, letting attacker run script in store admin context.

- Payout: $500
- Severity: low
- Program: Shopify
- Credited: tiago-danin
- Disclosed: 2019-06-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/602767
- Library page: https://bugbountylibrary.com/r/h1%3A602767
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:rest technique:chained technique:race-window vuln:xss

**Target:** Shopify admin embedded app postMessage handler (Shopify.API.Modal.initialize)
**Root cause:** The Modal.initialize postMessage handler accepts an attacker-controlled data.src and sets it as an iframe/modal source without validating the javascript: scheme, enabling DOM XSS.
**Steps:**
1. Open attacker page that calls window.open(location.origin+'/admin/themes','_blank') to get a handle to the admin window.
2. Build JSON {message:'Shopify.API.Modal.initialize', data:{src:''}} and postMessage it to the admin window.
3. First send with src='' to initialize the modal, then set json.data.src='javascript:alert(document.cookie)' and postMessage again.
4. Loop every 500ms until window.attackSuccess is set.
5. Trigger via a clickable link calling attack().
**How found:** Built on prior reports #422043 and #576532; reused the known Modal.initialize postMessage payload and swapped in a javascript: URI for data.src, using a retry loop to handle timing of the modal initialization.
**Exploitation:** Attacker lures a logged-in store admin to a malicious page; the page opens the admin themes URL in a new window and repeatedly postMessages the Modal.initialize payload with a javascript: src, executing script in the admin origin to perform unauthorized actions on embedded apps.
**Insight:** When a postMessage handler initializes a modal/iframe from data.src, test scheme injection (javascript:, data:) and use a two-step send (empty src first, then payload) with a retry loop to beat initialization timing.