# Arbitrary write on s3://shopify-delivery-app-storage/files

Shopify Delivery app's S3 upload policy only constrained key prefix to files/, letting any authenticated user overwrite other merchants' downloadable product files.

- Payout: $2,000
- Severity: high
- Program: Shopify
- Credited: brakhane
- Disclosed: 2015-10-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/93691
- Library page: https://bugbountylibrary.com/r/h1%3A93691
- Tags: domain:cloud impact:integrity kind:bounty platform:hackerone sev:high tech:aws tech:s3 technique:source-review vuln:access-control vuln:misconfiguration

**Target:** S3 presigned POST upload policy (shopify-delivery-app-storage bucket)
**Root cause:** The presigned POST policy only enforced starts-with files/ on the key rather than pinning the exact per-upload key, so any valid signature could write to any path under files/.
**Steps:**
1. Purchase or obtain a direct download link for a target shop's digital good
2. Capture the S3 signed URL to learn the victim's bucket key under files/
3. In your own shop, create a downloadable product and upload it, capturing the POST params (policy, signature, AWSAccessKeyId, etc.)
4. Replay the POST to shopify-delivery-app-storage with the same params but `key=files/<victim path>` to overwrite the victim's file
5. Confirm write by uploading `files/kitty.jpg` and `files/hackerone/simon/brakhane/kitty.jpg`
**How found:** Reviewed the S3 POST policy returned by the Delivery app and noticed the only key constraint was a starts-with files/ condition instead of an exact key match, implying cross-tenant write.
**Exploitation:** Attacker with any Shopify store obtains a valid presigned POST policy (valid ~1 day), then reuses it with an arbitrary key under files/ to overwrite another merchant's downloadable product, enabling malware/illegal content distribution under the victim's store.
**Insight:** When auditing presigned S3 POST policies, check whether the key condition is an exact match or merely starts-with; a prefix-only condition on a shared bucket enables cross-tenant overwrite of any object under that prefix.