# Path Traversal in App Proxy

Shopify App Proxy failed to normalize `../` in proxied paths, letting an anonymous user escape the configured app path and reach arbitrary hosts on the app's backend.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: ngalog
- Disclosed: 2020-08-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/869888
- Library page: https://bugbountylibrary.com/r/h1%3A869888
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:medium technique:recon vuln:path-traversal

**Target:** App Proxy endpoint on shop custom domain (/apps/ss/*)
**Root cause:** App Proxy forwards the request path to the app's configured host without escaping/normalizing `../` sequences, so traversal segments escape the intended `/proxy` prefix.
**Steps:**
1. Configure app proxy path `apps/ss` pointing to `https://app-host/proxy`.
2. Confirm `https://shop/apps/ss/test` returns content from `https://app-host/proxy/test`.
3. Send `GET /apps/ss/b.php/../../?shop=a&Shop=asd` with `Host: shop-domain`.
4. Observe response matches `https://app-host/` root, escaping the `/proxy` prefix.
**How found:** Researcher noticed the proxy prepends a fixed path (`/proxy`) to backend requests and hypothesized that unescaped `../` in the incoming path would let them climb out of that prefix; tested with a `b.php/../../` payload and compared the response to the host root.
**Exploitation:** Anonymous attacker sends a crafted path containing `../` through the shop's App Proxy endpoint; Shopify forwards the unnormalized path to the app backend, resolving outside the intended `/proxy` directory and returning content from the host root.
**Insight:** When a reverse proxy prepends a fixed path prefix to upstream requests, try inserting `../` after a dummy segment (e.g. `x/../../`) to climb out of the prefix; compare responses against the upstream root to confirm escape.