# Reflective Cross-site Scripting via Newsletter Form

Reflected XSS in Shopify newsletter form via Rails mass-assignment injecting an unfiltered quote, escaping the value attribute to add an autofocus onfocus javascript handler.

- Payout: $2,000
- Severity: high
- Program: Shopify
- Credited: gam817
- Disclosed: 2019-10-11
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/709336
- Library page: https://bugbountylibrary.com/r/h1%3A709336
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:ruby technique:chained technique:mass-assignment technique:param-pollution vuln:xss

**Target:** *.myshopify.com newsletter/contact form (contact[email] parameter)
**Root cause:** Rails mass assignment allowed an attacker-supplied array/param to inject a double quote into the rendered input value attribute; the app filtered user input but not the framework-generated quote, so the attribute could be escaped.
**Steps:**
1. Craft URL: `https://testbuguser.myshopify.com/?contact[email]%20onfocus%3djavascript:alert(%27xss%27)%20autofocus%20a=a&form_type[a]aaa`
2. Load the page; the injected quote from mass assignment closes the value attribute
3. onfocus=javascript:... plus autofocus fires the payload on page load without interaction
4. For data theft, use split/slice/pop/shift to parse the /admin/apps response and extract admin API keys, avoiding spaces and brackets that broke the payload
**How found:** Researcher noticed the newsletter form reflected the email param; hypothesized Rails mass assignment could inject a quote the app itself didn't filter, escaping the value attribute. Spaces and brackets broke the payload, so string manipulation primitives were used to work around filtering.
**Exploitation:** Victim (ideally an admin) loads the crafted storefront URL; autofocus triggers onfocus javascript on page load, executing in the store origin. Payload fetches /admin/apps and uses string split/slice/pop/shift to extract administrative API keys from the response, exfiltrating them.
**Escalation:** Chaining the XSS with same-origin requests to /admin/apps to harvest admin API keys, escalating from reflected XSS to administrative session/account compromise.
**Insight:** When a framework (Rails mass assignment, nested params) generates the surrounding quote/attribute, the app's input filter may not cover it—test array/nested param syntax like `form_type[a]` to smuggle characters the app never sanitizes.