# Unauthenticated access to details of hidden products in any shop via title emuneration

Password-protected Shopify shops leaked hidden product details via the buy_button channel JSON endpoint, letting unauthenticated attackers enumerate titles to read unpublished product data.

- Payout: $1,000
- Severity: medium
- Program: Shopify
- Credited: juhhga
- Disclosed: 2015-10-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/93394
- Library page: https://bugbountylibrary.com/r/h1%3A93394
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:rest technique:recon vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Shopify storefront product JSON endpoint (/products/<handle>.json?channel=buy_button)
**Root cause:** The buy_button channel endpoint skipped the storefront password-protection and product-visibility authorization checks applied to normal product routes.
**Steps:**
1. Confirm shop is password-protected: `GET http://sdfg674567.myshopify.com/`
2. Request `GET http://sdfg674567.myshopify.com/tee.json?channel=buy_button`
3. Observe full product JSON (body_html, price, variants) returned despite protection
4. Compare: `/products/tee.json` and `/products/tee/` are blocked
**How found:** Researcher noticed the buy_button channel parameter used by the admin Buy Button widget and tested it against a password-protected shop, finding it bypassed the storefront gate.
**Exploitation:** Unauthenticated attacker enumerates product titles/handles against the `?channel=buy_button` JSON endpoint on a password-protected shop to extract hidden product descriptions and prices.
**Insight:** Admin-facing widget endpoints (buy button, channel-scoped APIs) often skip storefront password/visibility checks; enumerate channel parameters on protected shops to reach unpublished product data.