# ██████ DOM XSS via Shopify.API.remoteRedirect

Shopify.API.remoteRedirect in apple-business-chat app accepted a javascript: location, letting a malicious theme page execute DOM XSS on the app's shopifycloud.com origin.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: yxw21
- Disclosed: 2019-09-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/646505
- Library page: https://bugbountylibrary.com/r/h1%3A646505
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:low technique:source-review vuln:xss

**Target:** Shopify app (apple-business-chat) embedded JS on shopifycloud.com
**Root cause:** The app's Shopify.API.remoteRedirect message handler passed an attacker-controlled `location` value into a redirect without validating the scheme, so a `javascript:` URI was evaluated in the app's origin.
**Steps:**
1. Install the apple-business-chat app on a store.
2. Modify theme code to open `https://apple-business-chat-commerce.shopifycloud.com` via `window.open`.
3. Repeatedly postMessage `{"message":"Shopify.API.remoteRedirect","data":{"location":"javascript:eval(atob('<base64 payload>'))"}}` to the popup with targetOrigin `location.origin`.
4. Payload sets `window.opener.postMessage('success',location.origin)` then `alert(document.domain)`; opener listens for 'success' to confirm.
5. Trigger by clicking the injected link on the storefront.
**How found:** Noticed the apple-business-chat app referenced a vulnerable JS file handling Shopify.API.remoteRedirect, then tested whether the location parameter accepted a javascript: scheme.
**Exploitation:** Attacker-controlled theme JS opens the app popup and floods it with remoteRedirect messages carrying a javascript: URI, executing arbitrary JS in the shopifycloud.com origin; the payload signals success back to the opener.
**Insight:** Shopify app iframes/popups that implement Shopify.API.remoteRedirect must whitelist http(s) URLs; test the `location` field with `javascript:` and `data:` schemes since postMessage handlers often only check message name, not value.