# Low privileged user can create high privileged user's KITCRM authorization token and can read and write message to KIT

Low-privileged Shopify staff could mint a high-privileged user's KITCRM token via /api/v1/arro_token id parameter, then read and send Kit messages as that user.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: sandeep_rj49
- Disclosed: 2021-02-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/909863
- Library page: https://bugbountylibrary.com/r/h1%3A909863
- Tags: area:web domain:api domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:auth-bypass vuln:idor

**Target:** KITCRM REST API (arro_token, messages endpoints) via Shopify Ping
**Root cause:** The /api/v1/arro_token endpoint accepts a caller-supplied staff member id and issues that user's KITCRM token without verifying the caller's identity matches the id or has privileges for it.
**Steps:**
1. Obtain low-privileged user's Shopify Ping access token via `POST /admin/api/xauth` with low-priv credentials.
2. Send `POST /api/v1/arro_token?access_token=<low_priv_token>&myshopify_domain=<shop>&id=<high_priv_staff_id>` to www.kitcrm.com.
3. Read high-privileged user's KITCRM token from the response.
4. Use token as `Authorization: Bearer <token>` on `GET /api/v2/messages` to read the victim's Kit conversation.
5. Send `POST /api/v2/messages` with body `{"incoming_message":"..."}` to issue instructions to Kit as the victim.
**How found:** Noticed low-privileged users are blocked from Ping UI but the xauth login API still issues them a Ping token, then observed arro_token takes a staff member id parameter and tested substituting a higher-privileged id.
**Exploitation:** Attacker with a low-privilege Shopify account logs into Ping via xauth, then swaps the id parameter to a high-privilege staff member id to obtain that user's KITCRM bearer token, using it to read and write Kit conversations and commands.
**Insight:** When a UI blocks low-privilege users but the underlying auth API still issues tokens, test downstream token-exchange endpoints that take a user id parameter for missing caller-to-id binding.