# XSS within Shopify Email App - Admin

Stored XSS in Shopify Email app via the store address 'Apartment, suite' field, letting a low-privileged settings user execute JS in the email template editor and steal CSRF tokens.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-09-14
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/869831
- Library page: https://bugbountylibrary.com/r/h1%3A869831
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:graphql technique:chained vuln:xss

**Target:** Shopify admin store address field rendered in Email app template editor
**Root cause:** The 'Apartment, suite, etc.' store address field accepts HTML without sanitization and is rendered unescaped in the Shopify Email template editor.
**Steps:**
1. Open Settings > Store address.
2. Insert `<img src="a:" onerror="...">` payload into the Apartment/suite field (bypasses 255-char limit).
3. Install Shopify Email App.
4. Select a template that renders the Apartment/suite field.
5. Payload fires, posts parent DOM to attacker server, evals returned JS to read csrf-token meta and alert it.
**How found:** Researcher tested whether the 255-char address field could be bypassed with a complex HTML payload and noticed it rendered unescaped in the Email template editor.
**Exploitation:** Attacker with Settings access stores an onerror payload; when a template renders the address, JS exfiltrates the parent page HTML to fbs.ninja, which extracts the csrf-token meta and returns JS that alerts it, enabling authenticated GraphQL requests to email.shopifyapps.com.
**Escalation:** Chained stored XSS with CSRF token theft to make authenticated requests to the Email app GraphQL endpoint.
**Insight:** Low-privileged settings fields that later render in a different app's template editor are prime stored-XSS sinks; test length-limit bypasses with compact event-handler payloads and check cross-app rendering contexts.