# deleted staff member can add his amazon marketplace web services account to the store.

Deleted staff member's saved Amazon MWS signup link still authorizes, letting them attach arbitrary Amazon fulfillment accounts to the store without admin access.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: zombiehelp54
- Disclosed: 2015-11-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/99374
- Library page: https://bugbountylibrary.com/r/h1%3A99374
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:oauth vuln:access-control vuln:auth-bypass vuln:business-logic

**Target:** Admin fulfillment_services/signup_for_mws endpoint and app.shopify.com/services/ping/amazon_mws callback
**Root cause:** The Amazon MWS registration callback endpoint (app.shopify.com/services/ping/amazon_mws?shop_id=) does not validate that the requesting user still has admin/settings permissions, so a pre-generated signed signup link remains valid after the staff member is deleted.
**Steps:**
1. Add a staff member with access to `settings`.
2. As that staff member, visit `https://<store>.myshopify.com/admin/fulfillment_services/signup_for_mws` and save the resulting amazon.com registration URL containing `AWSAccessKeyId`, `Signature`, `id`, and `returnPathAndParameters=%3Fshop_id%3D000000`.
3. Log out, log in as owner, and delete the staff member.
4. In a new browser, open the saved Amazon URL, log in with an Amazon account, and authorize Shopify.
5. Visit `https://<store>.myshopify.com/admin/settings/shipping/fulfillment_dropshipping` to confirm the account was added.
6. Repeat step 4 to add unlimited Amazon MWS accounts.
**How found:** Researcher noticed the MWS signup flow produced a signed, reusable Amazon URL and hypothesized the callback endpoint lacked permission re-validation after staff deletion.
**Exploitation:** A staff member who once had settings access saves the signed Amazon MWS registration link. After deletion, they reuse the link to bind their own Amazon seller account to the store, enabling them to fulfill the store's orders from their own Amazon inventory and repeatedly add more accounts the owner cannot remove.
**Escalation:** Reusing the saved link repeatedly adds unlimited attacker-controlled Amazon MWS accounts to the store.
**Insight:** Signed third-party OAuth/registration callback URLs that embed shop_id but not the acting user's identity can outlive the user's permissions; test whether saved signup links still work after revoking the initiating account.