# Ability to generate shipping labels in another store orders

Shopify mailbox GraphQL purchaseShippingLabels trusted a client-supplied sessionId and omitted hmac, letting any shop owner purchase shipping labels on another store's orders.

- Payout: hidden
- Severity: high
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-08-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/884159
- Library page: https://bugbountylibrary.com/r/h1%3A884159
- Tags: area:web domain:web impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:high tech:graphql technique:source-review vuln:access-control

**Target:** mailbox.shopifycloud.com GraphQL labels endpoint
**Root cause:** The purchaseShippingLabels mutation authorized by a sessionId query param/cookie tied to the attacker's own shop rather than the target shippingLabelId's owning store; the hmac integrity check was optional and could be dropped.
**Steps:**
1. Create a shipping label on own store, capture the `POST https://mailbox.shopifycloud.com/graphql/labels?sessionId=...` PurchaseShippingLabels request
2. Void the label, reopen order, note the target `shipping_label_ids` from the URL
3. As attacker shop, `POST https://mailbox.shopifycloud.com/session/authentication` with `Origin: https://{shop}.myshopify.com`, follow `redirectUrl`, install app, capture returned `id`
4. Replay the PurchaseShippingLabels request with target `gid://shopify/ShippingLabel/<id>`, `sessionId=<id>`, cookie `session=<id>`, and remove the `hmac` field
5. Send request; a new label is generated on the victim store's order
**How found:** Researcher noticed the label-purchase request carried both a sessionId and an hmac, hypothesized the hmac was the only cross-store guard, and tested replaying with a session from a different shop while removing hmac.
**Exploitation:** Attacker with any Shopify store obtains a mailbox session for their own shop, then replays the label-purchase mutation referencing a victim store's shippingLabelId while supplying their own sessionId/cookie and stripping hmac, causing Shopify to purchase a label against the victim's order.
**Insight:** When a GraphQL mutation carries both a session token and an hmac, test whether the hmac is actually enforced server-side by dropping it and swapping the session for one from a different tenant; object IDs in gid form are a good IDOR probe.