# 'Limited' RCE in certain places where Liquid is accepted

Shopify Liquid templates exposed Ruby Drop methods/properties, letting a shop admin call arbitrary no-arg methods and dump hidden fields like hashed passwords via to_yaml.

- Payout: $1,500
- Severity: high
- Program: Shopify
- Credited: brakhane
- Disclosed: 2015-11-10
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/98259
- Library page: https://bugbountylibrary.com/r/h1%3A98259
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Liquid notification email templates and checkout thank-you page
**Root cause:** Liquid template context exposed Drop objects whose methods and properties (including dangerous ones like systemu, instance_eval, to_yaml) were callable from user-controlled templates without proper method allowlisting.
**Steps:**
1. Navigate to shop admin Notification settings and edit New Order Template
2. Insert `{{ methods | json }}`, `{{ systemu }}`, `{{ class }}`, `{{ to_yaml }}` into the template
3. Click Preview to render and observe method list, class name, and YAML dump of the Drop
4. For data exfil: set last order toucher to victim, change customer email to attacker-controlled, resend order confirmation with `{{ to_yaml }}` in template
**How found:** Researcher experimented with Liquid template expressions in notification/checkout templates, discovered Drop objects exposed via `{{ class }}` and enumerated methods with `{{ methods | json }}`, then used `to_yaml` to dump hidden properties.
**Exploitation:** Admin-controlled Liquid templates render Drop objects; calling no-arg methods and to_yaml leaks hidden fields (e.g. hashed passwords). Combined with email resend, attacker redirects rendered order mail containing leaked data to their own address.
**Escalation:** Chained template method exposure with order-confirmation resend to exfiltrate hidden fields to attacker-controlled email.
**Insight:** In Liquid/Smarty-style template engines, probe `{{ class }}`, `{{ methods | json }}`, and `{{ to_yaml }}` to fingerprint the backing object and enumerate callable no-arg methods; Drop objects often leak more than intended.